IBM OmniFind 'esRunCommand' and 'estaskwrapper' Multiple Local Privilege Escalation Vulnerabilities

Bugtraq ID:	44944
Class:	Design Error
CVE:	CVE-2010-3895
Remote:	No
Local:	Yes
Published:	Nov 09 2010 12:00AM
Updated:	Nov 09 2010 12:00AM
Credit:	Fatih Kilic
Vulnerable:
Not Vulnerable:

IBM OmniFind 'esRunCommand' and 'estaskwrapper' Multiple Local Privilege Escalation Vulnerabilities

IBM OmniFind is prone to multiple local privilege-escalation vulnerabilities.

Exploiting these issues allows local attackers to execute arbitrary code with the privileges of the root.

Versions prior to IBM OmniFind 9.1 are vulnerable.

NOTE: These issues were previously covered in BID 44740 (IBM OmniFind Multiple Vulnerabilities) but have been given their own record for better documentation.

IBM OmniFind 'esRunCommand' and 'estaskwrapper' Multiple Local Privilege Escalation Vulnerabilities

An attacker may exploit this issue using commonly available tools.

The following exploit code is available:

• /data/vulnerabilities/exploits/cve-2010-3895.txt

IBM OmniFind 'esRunCommand' and 'estaskwrapper' Multiple Local Privilege Escalation Vulnerabilities

Solution:
Reportedly the vendor has fixed the issue, however Symantec has not confirmed it. Please contact the vendor for more information.

IBM OmniFind 'esRunCommand' and 'estaskwrapper' Multiple Local Privilege Escalation Vulnerabilities

References:

• IBM OmniFind Homepage (IBM)
  
• IBM OmniFind several issues (Fatih Kilic)
  
• IBM OmniFind - several vulnerabilities (Fatih Kilic )