Full Disclosure mailing list archives
Vulnerability in FortiClient SSL VPN - Linux
From: magikh0e <magikh0e () ihtb org>
Date: Sun, 29 May 2011 18:47:28 -0400
forticlientsslvpn suffers from an insecure lock file creation issue. Upon starting the forticlientsslvpn, the file 'forticlientsslvpn.lock' is created under the /tmp directory with octal permissions 0666. The client does not first check if this file exists, or if it is even currently owned by the user running the client. P.O.C Create a symlink from /tmp/forticlientsslvpn.lock to /some/file/owned_by_root as a non-root user. Then run the forticlientsslvpn client as root and the file you pointed at will then be overwritten upon execution. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Vulnerability in FortiClient SSL VPN - Linux magikh0e (May 30)
- Re: Vulnerability in FortiClient SSL VPN - Linux Valdis . Kletnieks (May 30)
- Re: Vulnerability in FortiClient SSL VPN - Linux magikh0e (May 30)
- Re: Vulnerability in FortiClient SSL VPN - Linux Valdis . Kletnieks (May 30)