EMC Networker 'nsrpush' Process Insecure File Permissions Local Privilege Escalation Vulnerability

Bugtraq ID:	59620
Class:	Design Error
CVE:	CVE-2013-0940
Remote:	No
Local:	Yes
Published:	May 02 2013 12:00AM
Updated:	Mar 19 2015 08:45AM
Credit:	Stefan Wuensch of Harvard University
Vulnerable:	EMC Networker 7.6.1 EMC Networker 7.6.1.5 EMC Networker 7.6.1.4 EMC Networker 7.6.1.3 EMC Networker 7.6.1.2 EMC Networker 7.6.1.1 EMC Networker 7.6.0.9 EMC Networker 7.6.0.8 EMC Networker 7.6.0.7 EMC Networker 7.6.0.6 EMC Networker 7.6.0.5 EMC Networker 7.6.0.4 EMC Networker 7.6.0.3 EMC Networker 7.6.0.2 EMC Networker 7.6 sp3 EMC Networker 7.6 Sp1 EMC Networker 7.6
Not Vulnerable:

EMC Networker 'nsrpush' Process Insecure File Permissions Local Privilege Escalation Vulnerability

EMC Networker is prone to a local privilege-escalation vulnerability because of an insecure file permission error.

A local attacker can exploit this issue to execute arbitrary code with root privileges.

The following versions are affected:

EMC NetWorker 7.6.5.2 and prior
EMC NetWorker 8.0.1.3 and prior

EMC Networker 'nsrpush' Process Insecure File Permissions Local Privilege Escalation Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

EMC Networker 'nsrpush' Process Insecure File Permissions Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

EMC Networker 'nsrpush' Process Insecure File Permissions Local Privilege Escalation Vulnerability

References:

• EMC Homepage (EMC)
  
• ESA-2013-028: EMC NetWorker Elevation of Privilege Vulnerability (Security Alert )