Altair Engineering PBS Pro 'pbs_mom' Insecure Temporary File Creation Vulnerability
BID:41449
Info
Altair Engineering PBS Pro 'pbs_mom' Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 41449 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 07 2010 12:00AM |
| Updated: | Jul 07 2010 12:00AM |
| Credit: | Bartlomiej Balcerek |
| Vulnerable: |
Altair Engineering PBS Pro 10.3 Altair Engineering PBS Pro 10.2 |
| Not Vulnerable: |
Altair Engineering PBS Pro 10.4 |
Discussion
Altair Engineering PBS Pro 'pbs_mom' Insecure Temporary File Creation Vulnerability
Altair Engineering PBS Pro creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.
Versions prior to PBS Pro 10.4 are vulnerable.
Altair Engineering PBS Pro creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.
Versions prior to PBS Pro 10.4 are vulnerable.
Exploit / POC
Altair Engineering PBS Pro 'pbs_mom' Insecure Temporary File Creation Vulnerability
An attacker uses readily available commands to exploit this issue.
The following proof-of-concept is available:
An attacker uses readily available commands to exploit this issue.
The following proof-of-concept is available:
Solution / Fix
Altair Engineering PBS Pro 'pbs_mom' Insecure Temporary File Creation Vulnerability
Solution:
Reports indicate that updates are available; Symantec has not verified this. Please see the references for more information.
Solution:
Reports indicate that updates are available; Symantec has not verified this. Please see the references for more information.
References
Altair Engineering PBS Pro 'pbs_mom' Insecure Temporary File Creation Vulnerability
References:
References:
- Vendor Homepage (Altair Engineering)
- PBS Pro race condition vulnerability (Bartlomiej Balcerek