The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
AOL Insecure Default Directory Permissions
------------------------------------------------------------------------
SUMMARY
Secunia Research has discovered a security issue in AOL, which can be
exploited by malicious, local users to manipulate arbitrary files.
The problem is that AOL sets insecure default permissions (grants
"Everyone" group "Full Control") on the "America Online 9.0" directory and
all child objects. This can be exploited to remove, manipulate, and
replace any of the application's files.
DETAILS
Vulnerable Systems:
* AOL version 9.0 Security Edition revision 4184.2340
Solution:
The vendor has issued an updated version (see the vendor statement).
Vendor Statement:
Overview
AOL has recently been made aware of a local security vulnerability in the
AOL client software. Upon installation, folders containing the AOL
software retain local file permissions such that any local user may be
able to overwrite files within the AOL program directories. A malicious
user may be able to overwrite legitimate AOL software with malicious code,
thereby escalating their local privileges if a privileged user were to
unknowingly execute the user's software.
Affected Products and Applications
The following AOL software versions are affected by this issue:
* All versions of the AOL client
Solutions
1. AOL Members using AOL 9.0 may simply log on to AOL and a fix will be
seamlessly applied to their system.
2. AOL Members using earlier versions of the AOL client are recommended
to upgrade to AOL 9.0 Security Edition
Acknowledgements
AOL would like to thank Secunia for their assistance in responsibly
addressing this issue.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0948>
CVE-2006-0948
Time Table:
09/02/2006 - Vendor notified.
09/02/2006 - Vendor response.
18/08/2006 - Public disclosure.
ADDITIONAL INFORMATION
The information has been provided by Carsten Eiram.
The original article can be found at:
<http://secunia.com/secunia_research/2006-08/>
http://secunia.com/secunia_research/2006-08/
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
