bugtraq - CVE-2008-4990 Enomaly ECP/Enomalism: Insecure temporary file creation vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <21606dcf0901300557s62c1ce81j83514a469ff50e29@mail.gmail.com>
Date: Fri, 30 Jan 2009 14:57:09 +0100
From: Sam Johnston <samj@...j.net>
To: Bugtraq <bugtraq@...urityfocus.com>
Subject: CVE-2008-4990 Enomaly ECP/Enomalism: Insecure temporary file creation 
	vulnerabilities

CVE-2008-4990 Enomaly ECP/Enomalism: Insecure temporary file creation
vulnerabilities

1. Synopsis

All versions of Enomaly ECP/Enomalism prior to 2.1.1 use temporary
files in an insecure
manner, allowing for symlink and command injection attacks.

2.  Impact Information

Background

Enomaly ECP (formerly Enomalism) is management software for virtual machines.

Description

Sam Johnston of Australian Online Solutions reported that enomalism2.sh uses
the /tmp/enomalism2.pid temporary file in an insecure manner.

Impact

A local attacker could perform a symlink attack to overwrite arbitrary files
on the system with root privileges, or inject arguments to the 'kill' command
to terminate or send arbitrary signals to any process(es) as root.

Exploits

a. ln -s /tmp/target /tmp/enomalism2.pid
b. echo "-9 1" > /tmp/enomalism2.pid

3.  Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All Enomaly ECP and Enomalism users should upgrade to the latest version.

History

2008-10-27 Bug initially reported to Enomaly by mail.

2008-10-27 Reuven Cohen acknowledged receipt and suggested a fix.

2008-11-06 CVE-2008-4990 allocated, update requested from Enomaly.

2008-11-08 Reuven Cohen publicly acknowledged the bug:

"Sam's security exploit is relativly minor and should not effect anyone with
decent dom0 access rules. We currently use random filenames that are pretty
hard to guess and if an un-authorized user were to gain access to the Dom0,
you'd probably have bigger issues to deal with. So this really only effects
"trusted" dom0 users. The resolution is don't give out dom0 access to untrusted
users, which is probably a good idea anyway. The whole purpose of ECP is to
abstract resources so you don't have to give that level of access to core
system resources. The next release of Enomaly ECP will address this issue."

2008-12-12 Enomaly ECP 2.1.1 (next subminor release) available with fix

2009-01-29 Enomaly ECP 2.2 (next minor release) available with fix