Trustwave WebDefend Local Privilege Escalation Vulnerability

Bugtraq ID:	47601
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 27 2011 12:00AM
Updated:	Apr 27 2011 12:00AM
Credit:	Nathan Power
Vulnerable:	Trustwave WebDefend 5.0
Not Vulnerable:

Trustwave WebDefend Local Privilege Escalation Vulnerability

Trustwave WebDefend is prone to a local privilege-escalation vulnerability.

Attackers with operator privileges can exploit this issue to view and manipulate the system files with root privileges. Successful exploits may allow attackers with insufficient (operator) privileges to gain root shell access on the affected appliance by modifying the login script of the operator account.

Trustwave WebDefend 5.0 is vulnerable; other versions may also be affected.

Trustwave WebDefend Local Privilege Escalation Vulnerability

A video demonstrating the exploit is available. Please see the references for more details.

Trustwave WebDefend Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Trustwave WebDefend Local Privilege Escalation Vulnerability

References:

• Trustwave WebDefend (Trustwave)
  
• Trustwave WebDefend Privilege Escalation Vulnerability (Nathan Power)