full-disclosure - Re: [FD] [CVE-2015-1234] Tanium all versions arbitrary file overwrite

Open Source and information security mailing list archives

Message-ID: <CAAJTn3_N+NUeQQsrFf8z=2aHV7Db8oenY2W4ydwZJHKvNYPJcQ@mail.gmail.com>
Date: Thu, 4 Jun 2015 23:53:22 -0700
From: Justin Burke <jburke@...ium.com>
To: fulldisclosure@...lists.org
Subject: Re: [FD] [CVE-2015-1234] Tanium all versions arbitrary file
	overwrite

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Earlier today, Tanium was made aware of a potential scripting vulnerability
affecting the Tanium Platform. Our internal investigation revealed
vulnerabilities in some scripts and fixes have been made available via a
content update. No upgrade of the Tanium Platform (including the Tanium
Server, Tanium Console, and Tanium Client) is required to close this
vulnerability.

The vulnerability can be exploited on any version of the Tanium Platform
containing the vulnerable code and can be fixed via a content update. The
vulnerability was found in four Sensors and applies only on Linux, Mac, and
Unix clients.

The vulnerability leverages an insecure temporary file creation process
used by these Sensors. When deployed on Linux, Mac or Unix systems,
non-privileged users can arbitrarily overwrite any file. The attack must
coincide with a legitimate Tanium operator asking a Question or executing
an Action using one of the affected Sensors:
- - Established Connections
- - Established Ports by Application
- - Listen Ports
- - Tanium Client Subnet

Tanium strongly advises customers to take immediate action and perform a
content upgrade. Customers may contact Tanium at support@...ium.com, visit
our Support Portal at http://support.tanium.com, or contact an assigned
Technical Account Manager for additional information or clarification on
content upgrade steps.

Security is of the upmost importance to Tanium and we encourage researchers
to quickly let us know when they find security vulnerabilities. To that
end, if you believe you‚Äôve found a security vulnerability in our product
please send an email to us at security@...ium.com. When reporting
vulnerabilities you can encrypt your message using our PGP key (
https://pgp.mit.edu/pks/lookup?op=get&search=0xD279B5765DFC25D8). Please
try and provide as much information in your report, such as version
information and any proof-of-concept code or special configurations
required to reproduce the issue. Once your message is received our security
and engineering teams will review your submission and provide a response as
quickly as possible.

Justin Burke
Staff Software Engineer, Tanium Inc.
jburke@...ium.com

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives