|
|
|
|
| |
Credit:
The information has been provided by Sam Johnston.
|
| |
Vulnerable Systems:
* Enomaly ECP/Enomalism versions prior to 2.1.1
Impact:
A local attacker could perform a symlink attack to overwrite arbitrary files on the system with root privileges, or inject arguments to the 'kill' command to terminate or send arbitrary signals to any process(es) as root.
Exploits:
a. ln -s /tmp/target /tmp/enomalism2.pid
b. echo "-9 1" > /tmp/enomalism2.pid
CVE Information:
CVE-2008-4990
History:
2008-10-27 Bug initially reported to Enomaly by mail.
2008-10-27 Reuven Cohen acknowledged receipt and suggested a fix.
2008-11-06 CVE-2008-4990 allocated, update requested from Enomaly.
2008-11-08 Reuven Cohen publicly acknowledged the bug:
"Sam's security exploit is relativly minor and should not effect anyone with decent dom0 access rules. We currently use random filenames that are pretty hard to guess and if an un-authorized user were to gain access to the Dom0, you'd probably have bigger issues to deal with. So this really only effects "trusted" dom0 users. The resolution is don't give out dom0 access to untrusted users, which is probably a good idea anyway. The whole purpose of ECP is to abstract resources so you don't have to give that level of access to core system resources. The next release of Enomaly ECP will address this issue."
2008-12-12 Enomaly ECP 2.1.1 (next subminor release) available with fix
2009-01-29 Enomaly ECP 2.2 (next minor release) available with fix
|
|
|
|
|
