Bug 23621

Summary: SUID exploit gives root access
Product: [Retired] Red Hat Linux Reporter: flitcraft33
Component: perlAssignee: Crutcher Dunnavant <crutcher>
Status: CLOSED ERRATA QA Contact: David Lawrence <dkl>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.1CC: dr, pekkas
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2001-01-10 16:03:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 15641    
Bug Blocks:    
Attachments:
Description Flags
perl script that exploits suidperl or any suid file for that matter, ugh none

Description flitcraft33 2001-01-08 23:20:59 UTC 
An attack that runs a script that will give root access if the hacker 
knows any binary that is SUID. I have the scripts, the source and the 
email addresses of the guys from Brazil who cooked this one up. 

My first experience with Brazilian PERL and I hope my last. My system was 
totally compromised by this as it grants root access.

I tried to do the Bugzilla search and I hope I did it right. This exploit 
was done on the standard 6.1 install.

Dan Sichel
Comment 1 flitcraft33 2001-01-08 23:34:19 UTC 
Created attachment 7264 [details]
perl script that exploits suidperl or any suid file for that matter, ugh
Comment 2 Andrew Bartlett 2001-01-10 08:37:41 UTC 
See bug 15630, and the RedHat advirory at
http://www.redhat.com/support/errata/RHSA-2000-048-03.html
Comment 3 flitcraft33 2001-01-10 16:02:59 UTC 
Note that script claims to work on ANY suid file, not just PERL. I have not 
tested this in any way shape or form however.
Comment 4 Pekka Savola 2001-01-10 18:36:31 UTC 
No, this is a standard exploit I have seen long since.  Nothing to do with Brazilian guys
except that they used your suidperl and passwd to get local root.

It cannot be used if your suidperl isn't setuid root, or has been updated, as per errata.