PatchLink Update Unix Client File clobbering vulnerability

2018.10.03
Risk: Medium
Local: Yes
Remote: No
CWE: N/A


CVSS Base Score: 4.6/10
Impact Subscore: 6.4/10
Exploitability Subscore: 3.9/10
Exploit range: Local
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

Title: PatchLink Update Unix Client File clobbering vulnerability Author: Larry W. Cashdollar, @_larry0 Date: 2008-01-17 CVE-ID:[CVE-2008-0525] Download Site: http://lumension.com/patch-management.jsp?rpLangCode=1&rpMenuId=118443 Vendor: http://lumension.com Vendor Notified: 2008-01-17 Vendor Contact: bugtraq Advisory: http://www.vapid.dhs.org/advisories/patchlink_update_unix_client_file_clobber_vulnerability.html Description: PatchLink Updateâ„¢ provides rapid, accurate and secure patch management, allowing you to proactively manage threats by automating the collection, analysis and delivery of patches throughout your enterprise. PatchLink Update significantly decreases the costs involved in securing your organization from worms, Trojans, viruses and other malicious threats. Vulnerability: The log rotation utility "logtrimmer" utilizes space in /tmp improperly and is subject to a symlink attack. By creating a targeted symlink a non root user can clobber root owned files causing DoS. Export: JSON TEXT XML Exploit Code: nobody:/tmp> ln -s /etc/shadow patchlink.tmp After logs are rotated /etc/shadow will be size 0, since patchlink.tmp is removed by logtrimmer after the log rotation process has finished.

References:

http://www.vapidlabs.com/advisory.php?v=87


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top