Novell NetMail 3.5.2a, 3.5.2b, and 3.5.2c, when running on Linux, sets the owner and group ID to 500 for certain files, which could allow users or groups with that ID to execute arbitrary code or cause a denial of service by modifying those files.
Novell NetMail versions 3.5.2a, 3.5.2b, and 3.5.2c on Linux are vulnerable to a privilege escalation attack. The vulnerability stems from incorrect file permissions, allowing unauthorized users to execute arbitrary code or cause a denial of service by manipulating files owned by a specific user or group ID.
Step 1: Identify Target Files: The attacker identifies files within the NetMail installation that are owned by the vulnerable user/group ID (500). These files are typically configuration files, scripts, or executable binaries used by the NetMail service.
Step 2: Craft Malicious Payload: The attacker creates a malicious payload. This could be a modified configuration file to execute arbitrary commands, a malicious script, or a replacement for a legitimate executable.
Step 3: Modify Target Files: The attacker, having the same user/group ID as the target files, overwrites the identified files with the malicious payload.
Step 4: Trigger Execution: The attacker waits for the NetMail service to use the modified files. This could be triggered by a specific action, a scheduled task, or a service restart.
Step 5: Code Execution/DoS: The NetMail service executes the attacker's payload with the permissions of the NetMail service, leading to arbitrary code execution or a denial-of-service condition.
The root cause is a flawed implementation of file ownership and permission management within the NetMail software. Specifically, the software incorrectly sets the owner and group ID of certain critical files to a common, potentially predictable, user or group ID (ID 500). This allows any user or group with that ID to modify these files. This is a classic example of a privilege escalation vulnerability. The flaw lies in the lack of proper access control checks and the use of a hardcoded, shared user/group ID for sensitive files. This allows an attacker to overwrite these files with malicious code, which will be executed with the permissions of the NetMail service when the service attempts to use the modified files.