|
|
| |
| "PatchLink Update provides rapid, accurate and secure patch management, allowing you to proactively manage threats by automating the collection, analysis and delivery of patches throughout your enterprise. PatchLink Update significantly decreases the costs involved in securing your organization from worms, Trojans, viruses and other malicious threats." A vulnerability in PatchLink's Update script for UNIX systems allows local attackers to cause the script to clobber (delete and re-create) any arbitrary files the attacker desires. |
| |
Credit:
The information has been provided by Vapidlabs.
The original article can be found at: http://vapid.dhs.org/d/doku.php?id=vapidlabs:patchlink_update_unix_client_file_clobber_vulnerability
|
| |
The log rotation utility logtrimmer utilizes space in /tmp improperly and is subject to a symlink attack. By creating a targeted symlink a non root user can clobber root owned files causing DoS.
Exploit:
nobody:/tmp> ln -s /etc/shadow patchlink.tmp
After logs are rotated
/etc/shadow will be size 0, since patchlink.tmp is removed by logtrimmer after the log rotation process has finished.
Fix
Create a subdirectory under /tmp or /var/tmp to work from.
For example adding:
mkdir /var/tmp/plink
chmod 700 /var/tmp/plink
|
|
|
|
|
