Sun PC NetLink Backup Restoration ACL Permissions Vulnerability

Bugtraq ID:	5281
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jul 22 2002 12:00AM
Updated:	Jul 22 2002 12:00AM
Credit:	Vulnerability disclosed by Sun Microsystems.
Vulnerable:	Sun PC NetLink 1.2 Sun PC NetLink 1.1 Sun PC NetLink 1.0
Not Vulnerable:	Sun PC NetLink 2.0

Sun PC NetLink Backup Restoration ACL Permissions Vulnerability

Sun PC NetLink is a server software package designed to provide a number of services to Microsoft Window's based machines. PC NetLink is able to perform network backup operations.

Under some conditions, ACL controls on files restored from backup may be reset to their default values. This behavior is related to the processing of symbolic links.

If ACL permissions are modified by this vulnerability, malicious local users may gain access to sensitive files.

Sun PC NetLink Backup Restoration ACL Permissions Vulnerability

No exploit is required.

Sun PC NetLink Backup Restoration ACL Permissions Vulnerability

Solution:
This issue has been resolved in PC Netlink 2.0 and later.

Sun PC NetLink Backup Restoration ACL Permissions Vulnerability

References:

• PC Netlink Product Page (Sun Microsystems)
  
• Sun Alert ID 27807: PC Netlink's Access Control List Permissions May be Lost Aft (Sun Microsystems)