Vulnerability Note VU#124289

Nik Software Sharpener Pro vulnerable to privilege escalation

Overview

The Nik Software Shapener Pro installs files with insecure permissions, which may allow a local attacker to elevate privileges.

I. Description

Nik Software Sharpener Pro is an Adobe Photoshop plug-in that provides image sharpening capabilities. The Nik Software Sharpener Pro installer sets insecure permissions on the plug-in files. The plug-ins can contain executable code, yet they are world-writable.

II. Impact

An unprivileged user may be able to modify files that can be executed by other users, which can allow privilege escalation.

III. Solution

We are currently unaware of a practical solution to this problem. Please consider the following workaround:

Remove write access to the Nik Sharpener plug-in files

By removing the ability of the "other" group to write to the plug-in files, this vulnerability can be mitigated.

Systems Affected

Vendor	Status	Date Updated
Nik Software	Vulnerable	28-Mar-2008

References

http://www.securityfocus.com/bid/27707/info

Credit

Thanks to Vlad Didenko for reporting this vulnerability.

This document was written by Will Dormann.

Other Information

Date Public	02/09/2008
Date First Published	03/28/2008 02:42:49 PM
Date Last Updated	03/28/2008
CERT Advisory
CVE Name
US-CERT Technical Alerts
Metric	0.77
Document Revision	3