OSSP mm library (libmm) before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attack.

s700_800 11.04 Webproxy server 2.0 update : 

Remotely exploitable potential vulnerabilities have been reported in CA-2002-21 and CVE-2002-0658.

s700_800 11.04 HP Praesidium Webproxy 1.0 server update : 

Remotely exploitable potential vulnerabilities have been reported in CA-2002-21 and CVE-2002-0658.

s700_800 11.04 Virtualvault 4.6 TGP IP Aliasing fix : 

Remotely exploitable potential vulnerabilities have been reported in CA-2002-21 and CVE-2002-0658.

s700_800 11.04 Virtualvault 4.5 inside server support : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - Remotely exploitable potential vulnerabilities have been     reported in CA-2002-21 and CVE-2002-0658.

  - Potential vulnerability in Apache web servers while     handling SSL requests.

s700_800 11.04 Virtualvault 4.6 Inside Server Update : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - Remotely exploitable potential vulnerabilities have been     reported in CA-2002-21 and CVE-2002-0658.

  - A potential remotely exploitable vulnerability in     handling of large data chunks in Apache-based web     servers. (HPSBUX00197 SSRT2332)

s700_800 11.04 Virtualvault 4.6 OpenSSH Update : 

Remotely exploitable potential vulnerabilities have been reported in CA-2002-21 and CVE-2002-0658.

s700_800 11.04 Virtualvault 4.6 inside server support : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - Potential vulnerability in Apache web servers while     handling SSL requests.

  - Remotely exploitable potential vulnerabilities have been     reported in CA-2002-21 and CVE-2002-0658.

s700_800 11.04 Virtualvault 4.5 Inside Admin Server Update : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - Remotely exploitable potential vulnerabilities have been     reported in CA-2002-21 and CVE-2002-0658.

  - A potential remotely exploitable vulnerability in     handling of large data chunks in Apache-based web     servers. (HPSBUX00197 SSRT2332)

Marcus Meissner and Sebastian Krahmer discovered and fixed a temporary file vulnerability in the mm shared memory library. This problem can be exploited to gain root access to a machine running Apache which is linked against this library, if shell access to the user 'www-data' is already available (which could easily be triggered through PHP).

Marcus Meissner and Sebastian Krahmer discovered a temporary file vulnerability in the mm library which is used by the Apache webserver.
This vulnerability can be exploited to obtain root privilege if shell access to the apache user (typically apache or nobody) is already obtained.

Updated mm packages are now available for Red Hat Linux Advanced Server. This update addresses possible vulnerabilities in how the MM library opens temporary files.

The MM library provides an abstraction layer which allows related processes to easily share data. On systems where shared memory or other inter-process communication mechanisms are not available, the MM library will emulate them using temporary files. MM is used in Red Hat Linux to providing shared memory pools to Apache modules.

Versions of MM up to and including 1.1.3 open temporary files in an unsafe manner, allowing a malicious local user to cause an application which uses MM to overwrite any file to which it has write access.

All users are advised to upgrade to these errata packages which contain a patched version of MM that is not vulnerable to this issue.

Thanks to Marcus Meissner for providing a patch for this issue.

ID	Name	Product	Family	Severity
17484	HP-UX PHSS_27656 : HPSBUX0209-217 Sec. Vulnerability in Apache OpenSSL (rev.2)	Nessus	HP-UX Local Security Checks	medium
17483	HP-UX PHSS_27655 : HPSBUX0209-217 Sec. Vulnerability in Apache OpenSSL (rev.2)	Nessus	HP-UX Local Security Checks	medium
17481	HP-UX PHSS_27637 : HPSBUX0209-217 Sec. Vulnerability in Apache OpenSSL (rev.2)	Nessus	HP-UX Local Security Checks	medium
17480	HP-UX PHSS_27627 : s700_800 11.04 Virtualvault 4.5 inside server support	Nessus	HP-UX Local Security Checks	medium
17477	HP-UX PHSS_27423 : s700_800 11.04 Virtualvault 4.6 Inside Server Update	Nessus	HP-UX Local Security Checks	medium
16849	HP-UX PHSS_27263 : HPSBUX0209-217 Sec. Vulnerability in Apache OpenSSL (rev.2)	Nessus	HP-UX Local Security Checks	medium
16808	HP-UX PHSS_27476 : s700_800 11.04 Virtualvault 4.6 inside server support	Nessus	HP-UX Local Security Checks	medium
16807	HP-UX PHSS_27477 : s700_800 11.04 Virtualvault 4.5 Inside Admin Server Update	Nessus	HP-UX Local Security Checks	medium
14974	Debian DSA-137-1 : mm - insecure temporary files	Nessus	Debian Local Security Checks	medium
13948	Mandrake Linux Security Advisory : mm (MDKSA-2002:045)	Nessus	Mandriva Local Security Checks	medium
12314	RHEL 2.1 : mm (RHSA-2002:154)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2002-0658

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium