Vulnerable Systems:
* Metasploit Project Metasploit Framework 3.5.2 and Prior
Local attackers can exploit this issue to overwrite arbitrary files in the Metasploit directory. Successful exploits may allow attackers to execute arbitrary code with elevated privileges. A security issue has been discovered in Metasploit Framework, which can be exploited by malicious, local users to gain escalated privileges.
The security issue is caused due to the application being installed with insecure filesystem permissions in the system's root drive. This can be exploited to create arbitrary files in certain directories (e.g. "postgresql\bin").
Successful exploitation e.g. allows execution of arbitrary code with LocalSystem privileges when the "frameworkPostgreSQL" service is restarted.
Disclosure Timeline:
Published : Jul 16 2012
Updated : Oct 12 2012
