Bsdmainutils Calendar Information Disclosure Vulnerability
BID:11077
Info
Bsdmainutils Calendar Information Disclosure Vulnerability
| Bugtraq ID: | 11077 |
| Class: | Access Validation Error |
| CVE: |
CVE-2004-0793 |
| Remote: | No |
| Local: | Yes |
| Published: | Aug 31 2004 12:00AM |
| Updated: | Jul 12 2009 07:06AM |
| Credit: | Steven Van Acker <[email protected]> disclosed this vulnerability. |
| Vulnerable: |
Debian bsdmainutils 6.0.14 |
| Not Vulnerable: |
Debian bsdmainutils 6.0.15 |
Discussion
Bsdmainutils Calendar Information Disclosure Vulnerability
The calendar utility contained in the bsdmainutils package on Debian GNU/Linux systems is reported susceptible to an information disclosure vulnerability. This is due to a lack of proper file authorization checks by the application.
The application fails to enforce permissions of included files when run as the superuser with the '-a' argument, therefore it is possible for a local attacker to create a calendar file that will disclose the contents of arbitrary, potentially sensitive files. This may aid them in further attacks against the affected computer.
By default, the package is installed with a crontab file that will not call the calendar utility. Systems are only affected if the crontab is enabled by administrators.
Debian GNU/Linux computers with bsdmainutils versions prior to 6.0.15 are reported to be vulnerable.
The calendar utility contained in the bsdmainutils package on Debian GNU/Linux systems is reported susceptible to an information disclosure vulnerability. This is due to a lack of proper file authorization checks by the application.
The application fails to enforce permissions of included files when run as the superuser with the '-a' argument, therefore it is possible for a local attacker to create a calendar file that will disclose the contents of arbitrary, potentially sensitive files. This may aid them in further attacks against the affected computer.
By default, the package is installed with a crontab file that will not call the calendar utility. Systems are only affected if the crontab is enabled by administrators.
Debian GNU/Linux computers with bsdmainutils versions prior to 6.0.15 are reported to be vulnerable.
Exploit / POC
Bsdmainutils Calendar Information Disclosure Vulnerability
An exploit is not required. An example calendar file sufficient to exploit this vulnerability was provided. This file would likely be located in '~/.calendar/calendar':
#define root Jun. 28<tab>cut_here
#include </etc/shadow>
Jun. 28<tab>Birthday of Steven Van Acker
Aug. 19<tab>Birthday of Andrew Griffith
(where <tab> should be replaced by an actual Tab character)
An exploit is not required. An example calendar file sufficient to exploit this vulnerability was provided. This file would likely be located in '~/.calendar/calendar':
#define root Jun. 28<tab>cut_here
#include </etc/shadow>
Jun. 28<tab>Birthday of Steven Van Acker
Aug. 19<tab>Birthday of Andrew Griffith
(where <tab> should be replaced by an actual Tab character)
Solution / Fix
Bsdmainutils Calendar Information Disclosure Vulnerability
Solution:
Debian has released version 6.0.15 of bsdmainutils for the unstable branch. Users of affected packages are urged to use Debians package management utilities to upgrade to the latest version of bsdmainutils.
Solution:
Debian has released version 6.0.15 of bsdmainutils for the unstable branch. Users of affected packages are urged to use Debians package management utilities to upgrade to the latest version of bsdmainutils.
References
Bsdmainutils Calendar Information Disclosure Vulnerability
References:
References:
- bsdmainutils changelog file for 6.0.15 (Debian)
- Possible root compromose with bsdmainutils 6.0.x < 6.0.15 (Debian testing/unstab (Steven Van Acker