Executive brief
iPass RoamServer, a service used for managing remote access and roaming authentication, contains a security flaw in how it handles temporary files. The software creates these files with insecure permissions that allow any user on the system to modify them. This could allow an attacker to tamper with application data or disrupt the service's operations.
Technical details
iPass RoamServer 3.1 is vulnerable to insecure file permissions. The application creates temporary files with world-writable (777 or equivalent) permissions, failing to restrict access to the owner or service account. An attacker with access to the system can modify the contents of these temporary files. Depending on how the application utilizes these files, this could lead to data corruption, information disclosure, or local privilege escalation if the service later processes the tampered data with higher privileges. The vulnerability is identified as a failure to set an appropriate umask or explicit file permissions during file creation.
Affected products
- iPass RoamServer 3.1
Timeline
- 1997-12-29: disclosed