TITLE:
RSBAC Privilege Escalation Vulnerabilities

SECUNIA ADVISORY ID:
SA11986

VERIFY ADVISORY:
http://secunia.com/advisories/11986/

CRITICAL:
Less critical

IMPACT:
Privilege escalation

WHERE:
Local system

SOFTWARE:
RSBAC 1.x
http://secunia.com/product/3649/

DESCRIPTION:
Two vulnerabilities have been reported in RSBAC, potentially allowing
malicious, local users to escalate their privileges.

1) In certain configurations, it is possible for a malicious,
unprivileged user to switch the AUTH module off. The problem is that
the FF, RC, and ACL modules fail to prevent the AUTH module from
being switched off, if self protection is disabled and module
switching is enabled. This only affects the AUTH module.

This vulnerability affects versions 1.0.8 through 1.2.2.

2) The "CREATE" module fails to check the mode values, allowing
malicious users to create suid and sgid files. This can be exploited
to escalate privileges inside the jail.

This vulnerability affects version 1.2.2.

SOLUTION:
Update to version 1.2.3.
http://www.rsbac.org/download/code.php

PROVIDED AND/OR DISCOVERED BY:
2) Brad Sprengler

ORIGINAL ADVISORY:
http://www.rsbac.org/download/code/v1.2.3/changes-v1.2.3.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------