Secunia

A vulnerability has been identified in SAP Development Tools, which can be exploited by malicious, local users to escalate their privileges on a vulnerable system.

After installation of the SAP Development Tools, two insecure suid binaries ("/usr/DevTool/bin/instdbmsrv" and "/usr/DevTool/bin/instlserver") are left on the system. The problem is that both binaries chmod and chown a file as "root", where some of the path to the file is specified in an environment variable ("$INSTROOT").

A malicious person can exploit this to escalate privileges to "root" by creating a special file with a certain file name ("pgm/dbmsrv" or "pgm/lserver"), place it in an arbitrary directory, and input the path to the file in the environment variable used by the two binaries. Afterwards one of the binaries can be executed, which will change ownership of the speciel file to "root" and set the suid-bit.

Execution of the malicious user's file will now be with "root" privileges.

Solution
The following fix has been suggested by the vendor:
Further details available in Customer Area

Provided and/or discovered by
KF

Original Advisory
http://www.secnetops.com/research/advisories/SRT2003-04-22-1336.txt

Deep Links
Links available in Customer Area