‘Multiple Vendor ypxfrd Map Handling Vulnerability’

Summary

‘ypxfrd daemon is used for speed up the distribution of large NIS maps from NIS master to NIS slave servers. An improper arguments validation in ypxfrd may allow local attacker to read any file on the system. This vulnerability has been found to affect multiple vendors.’

Credit:

‘The original advisory can be downloaded by going to:
http://isec.pl/vulnerabilities/0006.txt
The information has been provided by Janusz Niewiadomski.’


Details

‘When getdbm procedure is called, ypxfrd daemon creates a path to the /var/yp/domain/map file (where domain and map are arguments provided in the request). Unfortunately it fails to check if both arguments contain slash or dot characters, thus making databases outside /var/yp directory accessible. A symlink done can override the ‘.pag / .dir’ file extension limitation, allowing local attacker to read any file on the system.

The vendors were notified on August 27, 2002. The following systems are identified as affected by this vulnerability:
 * Sun Microsystems Solaris
 * SCO OpenServer
 * Caldera OpenLinux

Impact:
When ypxfrd is configured and running, local attacker is able to read any file on the system. As ypxfrd is typically run as root, this may lead to privilege escalation. It is also possible to remotely read DBM files outside /var/yp directory, depending on the secure networks configuration.

Vendor Response:
Please refer to CERT VU#538033 for more information.’

Categories: UNIX