McAfee Virex 'VShieldExclude.txt' File Symlink Flaw Lets Local Users Obtain Root Privileges
|
|
SecurityTracker Alert ID: 1017707
|
|
SecurityTracker URL: http://securitytracker.com/id?1017707
|
|
CVE Reference: CVE-2007-1226
, CVE-2007-1227
(Links to External Site)
|
Updated: May 18 2008
|
Original Entry Date: Feb 28 2007
|
Impact: Execution of arbitrary code via local system, Modification of system information, Root access via local system
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 7.7
|
Description: A vulnerability was reported in McAfee Virex. A local user can obtain root privileges on the target system.
A local user can specify files that should be excluded for scanning by modifying a configuration file within the '/Library/Application
Support' directory. A local user can modify the file to cause the scanner to fail to detect viruses on the local system.
A local
user can also delete the '/Library/Application Support/Virex/VShieldExclude.txt' file and then create a symbolic link (symlink)
from a critical file on the system to the '/Library/Application Support/Virex/VShieldExclude.txt' file. Then, when the system next
boots, the VShieldCheck process will write to the symlinked file with root privileges. A local user can exploit this to obtain
root privileges on the target system.
Kevin Finisterre of Netragard Research discovered this vulnerability.
The vendor was
notified on November 6, 2006.
The original advisory is available at:
http://www.netragard.com/html/recent_research.html
|
Impact: A local user can obtain root privileges on the target system.
|
Solution: The vendor has issued a fixed version (Virex 7.7 patch 1).
The McAfee advisory is available at:
https://knowledge.mcafee.com/SupportSite/dynamickc.do?externalId=518722&command=show&forward=nonthreadedKC&kcId=518722
|
Vendor URL: www.mcafee.com/ (Links to External Site)
|
Cause: State error
|
Underlying OS: UNIX (OS X)
|
Reported By: Netragard Security Advisories <advisories@netragard.com>
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
