Secunia Research: AOL Insecure Default Directory Permissions
======================================================================
Secunia Research 18/08/2006
- AOL Insecure Default Directory Permissions -
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
Vendor Statement.....................................................8
References...........................................................9
About Secunia.......................................................10
Verification........................................................11
======================================================================
1) Affected Software
AOL 9.0 Security Edition revision 4184.2340.
NOTE: Other versions may also be affected.
======================================================================
2) Severity
Rating: Less critical
Impact: Privilege Escalation, Manipulation of Data
Where: Local System
======================================================================
3) Vendor's Description of Software
Product Link:
http://downloads.channel.aol.com/windowsproducts
======================================================================
4) Description of Vulnerability
Secunia Research has discovered a security issue in AOL, which can be
exploited by malicious, local users to manipulate arbitrary files.
The problem is that AOL sets insecure default permissions (grants
"Everyone" group "Full Control") on the "America Online 9.0" directory
and all child objects. This can be exploited to remove, manipulate,
and replace any of the application's files.
======================================================================
5) Solution
The vendor has issued an updated version (see the vendor statement).
======================================================================
6) Time Table
09/02/2006 - Vendor notified.
09/02/2006 - Vendor response.
18/08/2006 - Public disclosure.
======================================================================
7) Credits
Discovered by Carsten Eiram, Secunia Research.
======================================================================
8) Vendor Statement
Overview
AOL has recently been made aware of a local security vulnerability in
the AOL client software. Upon installation, folders containing the
AOL software retain local file permissions such that any local user
may be able to overwrite files within the AOL program directories.
A malicious user may be able to overwrite legitimate AOL software with
malicious code, thereby escalating their local privileges if a
privileged user were to unknowingly execute the user's software.
Affected Products and Applications
The following AOL software versions are affected by this issue:
* All versions of the AOL client
Solutions
1. AOL Members using AOL 9.0 may simply log on to AOL and a fix will
be seamlessly applied to their system.
2. AOL Members using earlier versions of the AOL client are
recommended to upgrade to AOL 9.0 Security Edition
Acknowledgements
AOL would like to thank Secunia for their assistance in responsibly
addressing this issue.
======================================================================
9) References
The Common Vulnerabilities and Exposures (CVE) project has assigned
candidate number CVE-2006-0948 for the vulnerability.
======================================================================
10) About Secunia
Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:
http://secunia.com/
Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/secunia_security_advisories/
======================================================================
11) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2006-08/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================