SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   McAfee Virex Vendors:   McAfee
McAfee Virex 'VShieldExclude.txt' File Symlink Flaw Lets Local Users Obtain Root Privileges
SecurityTracker Alert ID:  1017707
SecurityTracker URL:  http://securitytracker.com/id/1017707
CVE Reference:   CVE-2007-1226, CVE-2007-1227   (Links to External Site)
Updated:  May 18 2008
Original Entry Date:  Feb 28 2007
Impact:   Execution of arbitrary code via local system, Modification of system information, Root access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 7.7
Description:   A vulnerability was reported in McAfee Virex. A local user can obtain root privileges on the target system.

A local user can specify files that should be excluded for scanning by modifying a configuration file within the '/Library/Application Support' directory. A local user can modify the file to cause the scanner to fail to detect viruses on the local system.

A local user can also delete the '/Library/Application Support/Virex/VShieldExclude.txt' file and then create a symbolic link (symlink) from a critical file on the system to the '/Library/Application Support/Virex/VShieldExclude.txt' file. Then, when the system next boots, the VShieldCheck process will write to the symlinked file with root privileges. A local user can exploit this to obtain root privileges on the target system.

Kevin Finisterre of Netragard Research discovered this vulnerability.

The vendor was notified on November 6, 2006.

The original advisory is available at:

http://www.netragard.com/html/recent_research.html

Impact:   A local user can obtain root privileges on the target system.
Solution:   The vendor has issued a fixed version (Virex 7.7 patch 1).

The McAfee advisory is available at:

https://knowledge.mcafee.com/SupportSite/dynamickc.do?externalId=518722&command=show&forward=nonthreadedKC&kcId=518722

Vendor URL:  www.mcafee.com/ (Links to External Site)
Cause:   State error
Underlying OS:  UNIX (macOS/OS X)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC