// back

Caché Insecure Installation File and Directory Permissions

BACKGROUND

InterSystems Corp.'s Caché is a post-relational database for e-applications that is optimized for web applications. More information about the application is available at
http://www.intersystems.com/cache/index.html.

DESCRIPTION

Caché installs with insecure file and directory permissions, thereby allowing local attackers to gain root access by manipulating items in the main package tree. The vulnerability specifically exists because files and directories are open to all users for read, write, and execute operations. An example of such a directory is the ecache/bin directory:

[farmer@vmlinux ecache]$ ls -ld bin
drwxrwxrwx 2 root root 4096 May 2 05:34 bin

The displayed permissions are that of a default install.

ANALYSIS

Two attack vectors exist by which any local attacker can gain root privileges:

* Overwriting a globally writeable binary that is executed from a set user id (setuid) root binary by the wrapper,  /cachesys/bin/cuxs.

* Executing a server side script from /cachesys/csp/user. The content in that directory is executed as root through the web interface.

DETECTION

Caché Database 5.x is affected. Older versions may be vulnerable as well.

WORKAROUND

Administrators can prevent exploitation by making file permissions more restrictive. This should prevent attackers from overwriting binaries or placing scripts in /cachesys/csp/user.

VENDOR RESPONSE

InterSystems provided an alert to its customer base that is viewable at http://www.intersystems.com/support/flash/index.html. In it, the company said that the installation defaults will be changed in Caché 4.1.16 and 5.0.3.

CVE INFORMATION

The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project has assigned the identification numbers to these issues:

CAN-2003-0497 overwrite Caché using setud cuxs program
CAN-2003-0498 code injection into /cachesys/csp

DISCLOSURE TIMELINE

03/11/2003                  First attack vector disclosed to iDEFENSE
04/18/2003                   Second attack vector disclosed to iDEFENSE
06/10/2003                   Research Completed on Issues
06/10/2003                   InterSystems Corporation notified
06/11/2003                   Response from David Shambroom of InterSystems
07/01/2003                    Coordinated public disclosure

CREDIT

Larry W. Cashdollar (lwc@vapid.ath.cx) discovered this vulnerability.