F-Secure Anti-Virus Internet Gatekeeper for Linux and F-Secure Anti-Virus Linux Gateway contain a flaw that may allow a malicious local user to elevate privileges to root. The issue is triggered when a user creates a malicious script named pattern_autoup.cgi in the current working directory, and executes the SUID script pattern_autoup_suid.cgi using its full path. The SUID script will execute the malicious script because it looks for it in the working directory. This flaw may lead to a loss of integrity.

Upgrade F-Secure Anti-Virus Internet Gatekeeper for Linux to version 2.15.484 or higher. Upgrade F-Secure Anti-Virus Linux Gateway to version 2.16 or higher, as these updates have been reported to fix this vulnerability.

It is also possible to correct the flaw by implementing the following workaround:
For F-Secure Internet Gatekeeper for Linux:
"chmod -s /opt/f-secure/fsigk/cgi/*suid.cgi"
For F-Secure Anti-Virus Linux Gateway:
"chmod -s /home/virusgw/cgi/*suid.cgi"

• Security Tracker: 1015159 1015160
• Milw0rm: 1297
• Exploit Database: 1297
• Bugtraq ID: 15339
• Secunia Advisory ID: 17467
• CVE ID: 2005-3546 (see also: NVD)
• Related OSVDB ID: 20513 20537 20538 20539 20540 20541 20542 20543 20544 20545 20546 20547 20548 20549 20551 20552
• ISS X-Force ID: 22966
• VUPEN Advisory: ADV-2005-2331
• Keyword: FSC-2005-3,TSEAD-200510-4
• Other Advisory URL: http://tigerteam.se/dl/exploits/TSEAD-200510-4.txt
  http://www.f-secure.com/security/fsc-2005-3.shtml
• Generic Exploit URL: http://www.securiteam.com/exploits/6S0032AEKQ.html

• Xavier de Leon - xaviertigerteam.se - Tigerteam.se Security