Home page logo

bugtraq logo Bugtraq mailing list archives

Vulnerability in Sawmill for Solaris v. 6.2.14
From: darky0da () hushmail com
Date: Mon, 11 Feb 2002 12:27:26 -0800

Hash: SHA1

_=_ Warped Force Advisory #2 _=_

Subject: Vulnerability in Sawmill for Solaris v. 6.2.14
Author: darky0da <darky0da () hushmail com>
Discovered: 2.8.02
Announced to BugTraq: 2.11.02
Vendor Status: Vendor notified on 2.9.02 and verified issue.
Upgrade v. 6.2.15 released on 2.10.02
Platform(s) Tested: Solaris 2.8; may also include other UNIX
Product Homepage: http://www.sawmill.net

Problem / Exploit: When the Sawmill executable is launched and the user enters
an initial password,the password is saved in file AdminPassword. This file
is created mode 0666 (world read/writeable permissions).

This happens regardless of the password_file_permissions setting in file
DefaultConfig, which is by default set to mode 0600. I have tried
this with user and root privileges and it occurs in each instance.

The default path to file AdminPassword is accessible to users.
The LogAnalysisInfo directory is created mode 0755.

The contents of the AdminPassword file are MD5'ed. It is trivial to
overwrite this value with a password of my choosing:

"rm AdminPassword; echo mypasswd | perl -p -e 'chomp' | md5sum | \
| sed 's/  -//' | perl -p -e 'chomp' > AdminPassword"

I have tested the above thoroughly and it works quite well, allowing me
access to all parts of the Sawmill pages.

Solution: Upgrade to version 6.2.15;
chmod 600 AdminPassword

sawmill folks

Hush provide the worlds most secure, easy to use online applications - which solution is right for you?
HushMail Secure Email http://www.hushmail.com/
HushDrive Secure Online Storage http://www.hushmail.com/hushdrive/
Hush Business - security for your Business http://www.hush.com/
Hush Enterprise - Secure Solutions for your Enterprise http://www.hush.com/

Version: Hush 2.1
Note: This signature can be verified at https://www.hushtools.com


  By Date           By Thread  

Current thread:
  • Vulnerability in Sawmill for Solaris v. 6.2.14 darky0da (Feb 11)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]