Veritas Volume Manager creates a world writable .server_pids file, which allows local users to add arbitrary commands into the file, which is then executed by the vmsa_server script.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Volume_manager | Symantec_veritas | 3.0.2 (including) | 3.0.2 (including) |
| Volume_manager | Symantec_veritas | 3.0.3 (including) | 3.0.3 (including) |
| Volume_manager | Symantec_veritas | 3.0.4 (including) | 3.0.4 (including) |
References
- http://archives.neohapsis.com/archives/bugtraq/2000-06/0151.html
- http://seer.support.veritas.com/tnotes/volumeman/230053.htm
- http://www.securityfocus.com/bid/1356
- http://archives.neohapsis.com/archives/bugtraq/2000-06/0151.html
- http://seer.support.veritas.com/tnotes/volumeman/230053.htm
- http://www.securityfocus.com/bid/1356