DavFS2 Failure To Enforce UNIX Filesystem Permissions Design Error Vulnerability

Bugtraq ID:	13770
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	May 25 2005 12:00AM
Updated:	May 25 2005 12:00AM
Credit:	This vulnerability was discovered by Andrew Pimlott <[email protected]>.
Vulnerable:	Davfs2 Davfs2 0.2.2
Not Vulnerable:

DavFS2 Failure To Enforce UNIX Filesystem Permissions Design Error Vulnerability

Davfs2 is prone to a security vulnerability. Reports indicate that UNIX file system permissions are not respected by Davfs2. A WebDAV filesystem that was mounted will have no permission restrictions at all.

A local attacker may take advantage of this design error to access or corrupt potentially sensitive data.

DavFS2 Failure To Enforce UNIX Filesystem Permissions Design Error Vulnerability

No exploit is required.

DavFS2 Failure To Enforce UNIX Filesystem Permissions Design Error Vulnerability

Solution:
The following unofficial patch is made available by Werner Baumann <[email protected]>. It should be noted that Symantec has not verified the integrity of this patch:

http://downloads.securityfocus.com/vulnerabilities/patches/davfs2-0.2.3-permissioncheck.diff

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

DavFS2 Failure To Enforce UNIX Filesystem Permissions Design Error Vulnerability

References:

• Davfs2 Homepage (Davfs2)
  
• user security hole (Andrew Pimlott )
  
• davfs2 does not honour Unix permissions (martin f krafft )