Saturday, November 8, 2008

V for Vendetta

My favorite antagonist Sam Johnston who infamously called for a boycott of Enomaly has been helping us find security holes in our Enomaly ECP. Fueled on a potent mix of rage and red bull Sam has been busy trying to find ways to exploit ECP. One of the great reasons for using an open source model is for exactly this reason. Anyone be it a friend or foe can assist with the discovery of security vunrabilites.

Sam's security exploit is relativly minor and should not effect anyone with decent dom0 access rules. We currently use random filenames that are pretty hard to guess and if an un-authorized user were to gain access to the Dom0, you'd probably have bigger issues to deal with. So this really only effects "trusted" dom0 users. The resolution is don't give out dom0 access to untrusted users, which is probably a good idea anyway. The whole purpose of ECP is to abstract resources so you don't have to give that level of access to core system resources. The next release of Enomaly ECP will address this issue.

Here is Sam's Full post.

Enomaly ECP/Enomalism: Insecure temporary file creation vulnerabilities


All versions of Enomaly ECP/Enomalism use temporary files in an insecure
manner, allowing for symlink and command injection attacks.

2. Impact Information


Enomaly ECP (formerly Enomalism) is management software for virtual machines.


Sam Johnston of Australian Online Solutions reported that uses
the /tmp/ temporary file in an insecure manner.


A local attacker could perform a symlink attack to overwrite arbitrary files
on the system with root privileges, or inject arguments to the 'kill' command
to terminate or send arbitrary signals to any process(es) as root.


a. ln -s /tmp/target /tmp/
b. echo "-9 1" > /tmp/
Never under estimate the power of a vendetta. Thanks Sam, let me know if there is anything I can do in return.

#DigitalNibbles Podcast Sponsored by Intel

If you would like to be a guest on the show, please get in touch.