AOH :: HP Unsorted E :: VA2632.HTM

Enomaly ECP/Enomalism: Multiple vulnerabilities in (redux)
Enomaly ECP/Enomalism: Multiple vulnerabilities in (redux)
Enomaly ECP/Enomalism: Multiple vulnerabilities in (redux)

Enomaly ECP/Enomalism: Multiple vulnerabilities in (redux)


All versions of Enomaly ECP/Enomalism[1] before 2.2.1 have multiple issues
relating to the use of temporary files in an insecure manner.

Fixes for CVE-2008-4990[2] and CVE-2009-0390[3] in 2.1.1 and 2.2 were found
to be ineffective.


Enomaly ECP (formerly Enomalism) is management software for virtual machines.


Sam Johnston[4] of Australian Online Solutions[5] reported multiple
vulnerabilities in
 - Race condition on $PIDFILE renders 2.1.1 fixes ineffective
 - Incomplete fixes in 2.1.1/2.2 fail to address stop/restart functions
 - Root ownership check (ls -l $PIDFILE |grep root) is trivially bypassed by:
   - changing the symlink's group to one containing the word 'root' or
   - creating a symlink to any filename containing the word 'root'
 - Process check (ps -p $PID |grep enomalism2d) is also trivially bypassed.


A local attacker could perform a symlink attack to overwrite arbitrary files
on the system with root privileges, inject arguments to the 'kill' command
to terminate or send arbitrary signals to any process(es) as root or launch
a denial of service attack by preventing the virtual machines from starting.


a. while true; do ln -s /etc/passwd /tmp/; done
b. echo "-9 1" > /tmp/
c. i. ln -s /tmp/root /tmp/
  ii. chgrp beetroot /tmp/


Change PIDFILE from /tmp/ to /var/run/


All Enomaly ECP and Enomalism users should upgrade to version 2.2.1[6] which
includes researcher fix.


2009-02-09 Bug initially reported to Enomaly by mail
2009-02-09 CVE(s) requested from Mitre; TBA
2009-02-09 Product Development Manager acknowledged receipt.
  "Thanks, we're incorporating a fix for the next release."
2009-02-10 Update announced[7] with no mention of security vulnerability:
  "ECP 2.2.1 is now available on both sourceforge and pypi.  This is a
  bug-fix release.  No new features have been added."
2009-02-14 Publication of vulnerability


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH
We do not send spam. If you have received spam bearing an email address, please forward it with full headers to