Ax.25 Tools AX.25 daemon 'setuid()' Remote Privilege Escalation Vulnerability

Bugtraq ID:	49107
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Aug 10 2011 12:00AM
Updated:	Aug 10 2011 12:00AM
Credit:	Dan Rosenberg
Vulnerable:	Ax.25 tools AX.25d 0
Not Vulnerable:

Ax.25 Tools AX.25 daemon 'setuid()' Remote Privilege Escalation Vulnerability

AX.25 daemon is prone to a remote privilege-escalation vulnerability.

Remote attackers can exploit this issue to execute arbitrary programs using root privileges. Successful exploits will completely compromise affected computers.

Ax.25 Tools AX.25 daemon 'setuid()' Remote Privilege Escalation Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or are aware of any more recent information, please mail us at: [email protected].

Ax.25 Tools AX.25 daemon 'setuid()' Remote Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Ax.25 Tools AX.25 daemon 'setuid()' Remote Privilege Escalation Vulnerability

References:

• CVE request (and disclosure): ax25d missing setuid return code check (Dan Rosenberg)
  
• Vendor Page (Ax.25 tools)