|
|
|
|
| |
Credit:
The information has been provided by Security Objectives Corporation.
The original article can be found at: http://www.security-objectives.com/advisories/SECOBJSADV-2008-05.txt
|
| |
Vulnerable Systems:
* Veritas Storage Foundation 5.0
Immune Systems:
* Veritas Software File System version 5.0 MP3
qioadmin will write arbitrary files (including /etc/shadow) to stderr. Each line will be prepended with a custom error message followed by file contents. Clearly, this can lead to privilege escalation by cracking the password ciphertext for the "superuser" or root account.
Workaround:
Remove the set-uid bit from the qioadmin binary.
chmod u-s /opt/VRTS/bin/qioadmin
Vendor response:
Symantec included a fix for this problem in the recent maintenance release Veritas Software File System 5.0 MP3.
Disclosure timeline:
11-Aug-2008 Discovery of Vulnerability
18-Aug-2008 Developed Proof-of-Concept
21-Aug-2008 Reported to Vendor
20-Oct-2008 Maintenance Release
22-Oct-2008 Published Advisory
CVE Information:
CVE-2008-4638
|
|
|
|
|
