RETIRED: Ocsinventory-Agent Perl Module Local Privilege Escalation Vulnerability

Bugtraq ID:	35612
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jul 08 2009 12:00AM
Updated:	Jul 09 2009 04:46PM
Credit:	The vendor
Vulnerable:	Ocsinventory-Ng Ocsinventory-Agent 0.0.9 .2
Not Vulnerable:	Ocsinventory-Ng Ocsinventory-Agent 0.0.9 .3

RETIRED: Ocsinventory-Agent Perl Module Local Privilege Escalation Vulnerability

Ocsinventory-Agent is prone to a local privilege-escalation vulnerability caused by a design error.

Attackers can exploit this issue to execute arbitrary Perl code with the privileges of the user running the vulnerable application.

Versions prior to Ocsinventory-Agent 0.0.9.3 are affected.

NOTE: This BID has been retired because it is a duplicate of BID 35593.

RETIRED: Ocsinventory-Agent Perl Module Local Privilege Escalation Vulnerability

An attacker can exploit this issue by placing a Perl module in an arbitrary directory and enticing an unsuspecting user to run the affected application from this directory.

RETIRED: Ocsinventory-Agent Perl Module Local Privilege Escalation Vulnerability

Solution:
The vendor has released an update. Please see the references for details.


Ocsinventory-Ng Ocsinventory-Agent 0.0.9 .2

• OCS Inventory Team Ocsinventory-Agent-0.0.9.3.tar.gz
  http://nana.rulezlan.org/%7Egoneri/ocsinventory-agent/Ocsinventory-Age nt-0.0.9.3.tar.gz

RETIRED: Ocsinventory-Agent Perl Module Local Privilege Escalation Vulnerability

References:

• Ocsinventory-Agent (CPAN)
  
• Security issue found in Unified agent prior 0.0.9.3 (OCS Inventory Team)