LutelWall Multiple Insecure File Creation Vulnerabilities
BID:13863
Info
LutelWall Multiple Insecure File Creation Vulnerabilities
| Bugtraq ID: | 13863 |
| Class: | Design Error |
| CVE: |
CVE-2005-1879 |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 06 2005 12:00AM |
| Updated: | Jul 12 2009 02:56PM |
| Credit: | Eric Romang <[email protected]> of ZATAZ Audit is credited with the discovery of this vulnerability. |
| Vulnerable: |
Tomasz Lutelmowski LutelWall 0.97 Tomasz Lutelmowski LutelWall 0.96 Tomasz Lutelmowski LutelWall 0.95 Tomasz Lutelmowski LutelWall 0.94 Tomasz Lutelmowski LutelWall 0.93 Tomasz Lutelmowski LutelWall 0.92 Tomasz Lutelmowski LutelWall 0.91 Adrian Pascalau GIPTables Firewall 1.1 Adrian Pascalau GIPTables Firewall 1.0 |
| Not Vulnerable: | |
Discussion
LutelWall Multiple Insecure File Creation Vulnerabilities
LutelWall is prone to multiple insecure file creation vulnerabilities. This issues are due to a design error that causes the application to fail to verify the existence of files before writing to them.
An attacker may leverage this issue to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable utility. Due to the nature of this script, it is likely that only users with superuser privileges will be executing it.
One of the temporary files is used to store the downloaded LutelWall script file in an upgrade process. Attackers may be able to exploit the race condition between when the temporary file is created, and when LutelWall is overwritten with the contents of the temporary file. This would allow attackers to overwrite the LutelWall script with an arbitrary executable, so that further invocations of LutelWall by the superuser would cause the attacker-supplied code to be executed with superuser privileges.
LutelWall is prone to multiple insecure file creation vulnerabilities. This issues are due to a design error that causes the application to fail to verify the existence of files before writing to them.
An attacker may leverage this issue to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable utility. Due to the nature of this script, it is likely that only users with superuser privileges will be executing it.
One of the temporary files is used to store the downloaded LutelWall script file in an upgrade process. Attackers may be able to exploit the race condition between when the temporary file is created, and when LutelWall is overwritten with the contents of the temporary file. This would allow attackers to overwrite the LutelWall script with an arbitrary executable, so that further invocations of LutelWall by the superuser would cause the attacker-supplied code to be executed with superuser privileges.
Exploit / POC
LutelWall Multiple Insecure File Creation Vulnerabilities
An exploit is not required.
An exploit is not required.
Solution / Fix
LutelWall Multiple Insecure File Creation Vulnerabilities
Solution:
Users of Gentoo Linux can upgrade by performing the following command:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-firewall/lutelwall-0.98"
Currently we are not aware of any vendor-supplied patches for this issue. If you
feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Users of Gentoo Linux can upgrade by performing the following command:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-firewall/lutelwall-0.98"
Currently we are not aware of any vendor-supplied patches for this issue. If you
feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
LutelWall Multiple Insecure File Creation Vulnerabilities
References:
References:
- GIPTables Firewall Home Page (Adrian Pascalau)
- LutelWall Home Page (Tomasz Lutelmowski)
- GIPTables Firewall <= v1.1 insecure temporary file creation (ZATAZ Audits
- LutelWall <= 0.97 insecure temporary file creation (ZATAZ Audits