[UNIX] Caché Insecure Installation File and Directory Permissions

From: SecuriTeam (support_at_securiteam.com)
Date: 07/01/03

  • Next message: SecuriTeam: "[UNIX] VMware Workstation Privilege Escalation Via Symlink Manipulation" 
    To: list@securiteam.com
Date: 1 Jul 2003 14:56:04 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security in Canada

    Toronto-based Sunrays Technologies is now Beyond Security's representative in Canada.
    We welcome ISPs, system integrators and IT systems resellers
    to promote the most advanced vulnerability assessment solutions today.

    Contact us at 416-482-0038 or at canadasales@beyondsecurity.com

    - - - - - - - - -

      Caché Insecure Installation File and Directory Permissions
    ------------------------------------------------------------------------

    SUMMARY

    InterSystems Corp.'s Caché is a "post-relational database for
    e-applications that is optimized for web applications". Caché installs
    with insecure file and directory permissions, thereby allowing local
    attackers to gain root access by manipulating items in the main package
    tree.

    DETAILS

    Vulnerable systems:
     * Caché Database version 5.x

    Immune systems:
     * Caché Database version 4.1.16
     * Caché Database version 5.0.3

    The vulnerability specifically exists because files and directories are
    open to all users for read, write, and execute operations. An example of
    such a directory is the ecache/bin directory:

    [farmer@vmlinux ecache]$ ls -ld bin
    drwxrwxrwx 2 root root 4096 May 2 05:34 bin

    The displayed permissions are that of a default install.

    Analysis:
    Two attack vectors exist by which any local attacker can gain root
    privileges:

     * Overwriting a globally writeable binary that is executed from a set
    user id (setuid) root binary by the wrapper, /cachesys/bin/cuxs.

     * Executing a server side script from /cachesys/csp/user. The content in
    that directory is executed as root through the web interface.

    Workaround:
    Administrators can prevent exploitation by making file permissions more
    restrictive. This should prevent attackers from overwriting binaries or
    placing scripts in /cachesys/csp/user.

    Vendor fix:
    InterSystems provided an alert to its customer base that is viewable at
    <http://www.intersystems.com/support/flash/index.html>
    http://www.intersystems.com/support/flash/index.html. In it, the company
    said that the installation defaults will be changed in Caché 4.1.16 and
    5.0.3.

    Disclosure timeline:
    11 MAR 2003 First attack vector disclosed to iDEFENSE
    18 APR 2003 Second attack vector disclosed to iDEFENSE
    10 JUN 2003 Research Completed on Issues
    10 JUN 2003 InterSystems Corporation notified
    11 JUN 2003 Response from David Shambroom of InterSystems
    01 JUL 2003 Coordinated Public Disclosure

    ADDITIONAL INFORMATION

    The original advisory is available for download from:
     <http://www.idefense.com/advisory/07.01.03.txt>
    http://www.idefense.com/advisory/07.01.03.txt

    The information has been provided by <mailto:listserv@idefense.com>
    iDEFENSE Labs, the vulnerability has been discovered by
    <mailto:lwc@vapid.ath.cx> Larry W. Cashdollar.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] VMware Workstation Privilege Escalation Via Symlink Manipulation"