Axent ESM 5.0 User Profile Permission Vulnerability

TITLE: Axent ESM 5.0 User Profile Permission Vulnerability
CLASS: Design Error
CVE:
REMOTE: No
LOCAL: Yes
PUBLISHED: Jul 12 1999 12:00AM
UPDATE: Jul 12 1999 12:00AM
CREDIT: This vulnerability was forwarded to the staff at Security-Focus.com.
VULNERABLE:

Axent ESM 5.0
-AT&T SVR4 4.0
-Digital OpenVMS 7.1
-Digital UNIX 4.0
-HP HP-UX 11.0
-HP HP-UX 10.0
-HP HP-UX 9.0
-IBM AIX 4.3
-IBM AIX 4.2
-IBM AIX 4.1
-SGI IRIX 6.0
-SGI IRIX 5.3
-Sun Solaris 7.0
-Sun Solaris 2.6
-Sun Solaris 2.5
-Sun Solaris 2.4
-Sun Solaris 2.3
-Sun Solaris 2.2
-Sun Solaris 2.1
-Sun Solaris 2.0
-Sun SunOS 4.1.4
-Sun SunOS 4.1.3
NOT VULNERABLE:
Axent ESM 4.5
-AT&T SVR4 4.0
-Digital OpenVMS 7.1
-Digital OSF/1 3.0
-Digital UNIX 4.0
-Digital UNIX 3.2 G
-HP HP-UX 11.0
-HP HP-UX 10.0
-HP HP-UX 9.0
-IBM AIX 4.3
-IBM AIX 4.2
-IBM AIX 4.1
-SGI IRIX 6.0
-SGI IRIX 5.3
-Sun Solaris 2.6
-Sun Solaris 2.5
-Sun Solaris 2.4
-Sun Solaris 2.3
-Sun Solaris 2.2
-Sun Solaris 2.1
-Sun Solaris 2.0
-Sun SunOS 4.1.4
-Sun SunOS 4.1.3

Vai alla pagina originale su Security Focus

Discussion

Certain checks within Axent's ESM 5.0 for Unix may prevent legitimate users from logging on to scanned hosts.

Specifically, four checks within the security auditing program may cause this denial of service:
Check PATH using 'su'
Check PATH by modifying startup script
Check umask using 'su'
Check umask by modifying startup script

These checks are not enabled in the default policy templates.

When ESM is checking PATH (or umask) values, it will 'su' to the user's account. If the user's script calls a menu function, ESM will not respond and the check will hang. To overcome this problem, ESM copies the startup script to the /tmp directory, adds additional values to the end of the script, and copies the script back to the user's directory. The new values in the script will echo the PATH and umask values to a file called .esmvalues in the user's home directory the next time the user logs in. When ESM is run again, it will read the contents of .esmvalues to determine the PATH and umask values. This procedure eliminates the problems associated with 'su'ing to the account and hanging on a menu call.

Unfortunately, when ESM copies the file to /tmp, file ownership and permissions are changed to 'root'. When the file is copied back to the user's directory, only root has access - legitimate users will not be able to execute their login script.

Exploit

See discussion.

Solution

Solution:
Use ESM version 4.5. The Hot-Fix for this problem will be available from Axent Support in August and should be remotely installable. Axent ESM 5.0.1 (as of this post date is to be released) will include the hot-fix.

The following message has been provided to Security Focus from AXENT:

AXENT appreciates the opportunity to respond to the issues raised with this posting. The first statement indicates that users cannot log into scanned hosts. This is not true--users can log in, but they will not be able to access their startup scripts. This bug constitutes more of an inconvenience to the user, than a security threat.

The bug was discovered a short time ago and there is a current procedure for correcting the ownership of files that may have been affected. Currently there is a newer version of the affected usrfiles module that does not change the ownership of the startup scripts. This procedure and/or the updated module can be obtained by contacting AXENT support. This version of the usrfiles module is also included in the August HotFix for ESM that customers can remotely install on all systems. The hot fix is only needed for ESM 5.0 UNIX agents. Earlier versions of ESM agents do not have this problem. The fix will also be included in the upcoming ESM 5.0.1 release.

As was indicated in the original posting, this check was not turned on by default and most ESM 5.0 customers have probably not used it. If you desire the procedure to correct the affected files or the updated module, please contact AXENT support at support@axent.com

References

References:

PhpLog

BNLug Benevento Linux Users Group