Vulnerability Assessment & Network Security Forums
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery.
Vulnerability Assessment Details
Check for the version of the permissions package
Detailed Explanation for this Vulnerability Assessment
The remote host is missing the patch for the advisory SUSE-SA:2005:062 (permissions).
SUSE LINUX ships with three pre defined sets of permissions, 'easy',
'secure' and 'paranoid'. The chkstat program contained in the
permissions package is used to set those permissions to the chosen
level. Level 'easy' which is the default permits some world writeable
directories. /usr/src/packages/RPMS and subdirectories is among
them. To prevent users from playing tricks in there e.g. linking to
/etc/shadow chkstat doesn't touch symlinks or files with an hardlink
count != 1.
Stefan Nordhausen discovered a way to trick this check. To gain
access to e.g. /etc/shadow a malicious user has to place a hardlink
to that file at a place that is modified by chkstat. chkstat will
not touch the file because it has a hardlink count of two. However,
if the administrator modifies the user database the original
/etc/shadow gets deleted and replaced by a new one. That means the
hardlink count of the file created by the malicious user drops to
one. At this point chkstat will modify the file's permissions so
anyone can read it. So it's technically impossible for chkstat to
modify permissions of files in world writeable directories in a
One such world writeable directoy in level 'easy' is
/usr/src/packages/RPMS. Only subdirectories need to be adjusted in
this case. Since normal users cannot create hard links to
directories the problem can be solved by telling chkstat to not
accept regular files. Another problematic directory is /var/games.
Only members of group 'games' may write to it but it's likely that
games with setgid 'games' are exploitable to permit user to gain
group 'games' membership.
The updated permissions package now tells chkstat when to only
accept directories and no longer touches anything below /var/games
to solve the described problems. On SUSE Linux 9.0 xmcd contained
world writeable directories that suffered from the same problems.
Updated xmcd packages for SUSE Linux 9.0 are therefore provided as
We like to thank Stefan Nordhausen for pointing out the problems.
Solution : http://www.suse.de/security/advisories/2005_62_permissions.html
Network Security Threat Level: Medium
Networks Security ID:
Vulnerability Assessment Copyright: This script is Copyright (C) 2005 Tenable Network Security
|IBM DX360 M3 SERVER TWO E5506 2.13GHZ 4GB 3 X 1TB SATA 2 X TESLA M1060 CONNECTX-
|IBM HS22 BLADECENTER SERVER E5520 2.26GHZ 8GB RAM 2 X 1TB SATA
|IBM HS22V BLADECENTER SERVER E5520 2.26GHZ 24GB NO HDD
|IBM DX360 M3 SERVER TWO L5530 2.40GHZ 48GB 2 X 300GB 10K SAS 2 X TESLA M1060 CON
No Discussions have been posted on this vulnerability.