Nortel Net Direct SSL VPN Client Race Condition Lets Local Users Gain Root Privileges
|
|
SecurityTracker Alert ID: 1017678
|
|
SecurityTracker URL: http://securitytracker.com/id?1017678
|
|
CVE Reference: CVE-2007-1057
(Links to External Site)
|
Updated: May 19 2008
|
Original Entry Date: Feb 21 2007
|
Impact: Execution of arbitrary code via local system, Modification of user information, Root access via local system
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 6.0.5
|
Description: A vulnerability was reported in the Nortel Net Direct client for Linux. A local user can obtain root privileges on the target system.
A local user can exploit a race condition to modify certain temporary files to cause arbitrary code to be executed on the target
system when the target user starts a VPN session. The code will run with root privileges.
The software creates the world-writable
client, askpass, and surun files in '/tmp/NetDirect'. A local user can modify these files after they are created but before they
are run.
Nortel credits Jon Hart of spoofed.org with reporting this vulnerability.
The original advisory, including demonstration
exploit code, is available at:
http://spoofed.org/blog/archive/2007/02/nortel_vpn_unix_client_local_root_compromise.html
|
Impact: A local user can obtain root privileges on the target system.
|
Solution: The vendor has issued a fixed version (6.0.5).
The Nortel advisory is available at:
http://www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=540071&RenditionID=&poid=null
|
Vendor URL: www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=540071&RenditionID=&poid=null (Links to External Site)
|
Cause: Access control error, State error
|
Underlying OS: Linux (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 21 Feb 2007 08:16:31 -0500
Subject: Nortel Net Direct
|
http://spoofed.org/blog/archive/2007/02/nortel_vpn_unix_client_local_root_compromise.html
|
|
