PrimeBase SQL Database Server Insecure Default Binary Permissions Vulnerability

Bugtraq ID:	8772
Class:	Configuration Error
CVE:
Remote:	No
Local:	Yes
Published:	Oct 06 2003 12:00AM
Updated:	Oct 06 2003 12:00AM
Credit:	Discovery is credited to "Larry W. Cashdollar" <[email protected]>.
Vulnerable:	SNAP Innovation PrimeBase SQL Database Server 4.2
Not Vulnerable:

PrimeBase SQL Database Server Insecure Default Binary Permissions Vulnerability

The PrimeBase SQL Database Server binary is installed with world-writeable permissions by default. A local attacker could take advantage of this issue to execute arbitrary code by replacing or modifying the binary, potentially allowing for privilege escalation.

This issue was reported for PrimeBase running on Unix/Linux variants.

PrimeBase SQL Database Server Insecure Default Binary Permissions Vulnerability

There is no exploit required.

PrimeBase SQL Database Server Insecure Default Binary Permissions Vulnerability

Solution:
This issue will reportedly be addressed in an upcoming release. This has not been confirmed by Symantec.

---

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PrimeBase SQL Database Server Insecure Default Binary Permissions Vulnerability

References:

• PrimeBase Homepage (SNAP Innovation)
  
• SNAP Innovation's PrimeBase Database 4.2 poor default file permissions. ("Larry W. Cashdollar" )