Qualcomm Qpopper Poppassd Local Arbitrary Command Execution Vulnerability

Bugtraq ID:	7447
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 28 2003 12:00AM
Updated:	Apr 28 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to "dong-h0un U" <[email protected]>
Vulnerable:	Qualcomm qpopper 4.0.5 fc2 Qualcomm qpopper 4.0.5 Qualcomm qpopper 4.0.4 Qualcomm qpopper 4.0.3 + Caldera OpenServer 5.0.6 + Caldera OpenServer 5.0.5 Qualcomm qpopper 4.0.2 Qualcomm qpopper 4.0.1 + Redhat Linux 7.1 + Redhat Linux 7.0 + Sun Cobalt RaQ 4 Qualcomm qpopper 4.0 b14 Qualcomm qpopper 4.0 3 Qualcomm qpopper 4.0 2 Qualcomm qpopper 4.0 1 Qualcomm qpopper 4.0
Not Vulnerable:

Qualcomm Qpopper Poppassd Local Arbitrary Command Execution Vulnerability

Qualcomm Qpopper Poppassd has been reported prone to a local arbitrary command execution vulnerability.

poppassd is installed with setUID root permissions set by default and is executable by all local system users. There has been an issue reported in poppassd that may allow a local user to execute arbitrary commands in the context of the root user. An attacker may supply a path to a malicious executable and the executable will be called as poppassd is run.

An attacker may exploit this condition to elevate privileges on the local system. Because poppassd is by default setUID root, privileges attained may be root.

Qualcomm Qpopper Poppassd Local Arbitrary Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Qualcomm Qpopper Poppassd Local Arbitrary Command Execution Vulnerability

References:

• Qpopper Homepage (Qualcomm)
  
• Qpopper v4.0.x poppassd local root exploit ( "dong-h0un U" )