Vulnerability Note VU#124289

Nik Software Sharpener Pro vulnerable to privilege escalation

Overview

The Nik Software Shapener Pro installs files with insecure permissions, which may allow a local attacker to elevate privileges.

I. Description

Nik Software Sharpener Pro is an Adobe Photoshop plug-in that provides image sharpening capabilities. The Nik Software Sharpener Pro installer sets insecure permissions on the plug-in files. The plug-ins can contain executable code, yet they are world-writable.

II. Impact

An unprivileged user may be able to modify files that can be executed by other users, which can allow privilege escalation.

III. Solution

We are currently unaware of a practical solution to this problem. Please consider the following workaround:

Remove write access to the Nik Sharpener plug-in files

By removing the ability of the "other" group to write to the plug-in files, this vulnerability can be mitigated.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Nik Software	Vulnerable	28-Mar-2008

References

http://www.securityfocus.com/bid/27707/info

Credit

Thanks to �Vlad Didenko for reporting this vulnerability.

This document was written by Will Dormann.

Other Information

Date Public:	2008-02-09
Date First Published:	2008-03-28
Date Last Updated:	2008-03-28
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	0.77
Document Revision:	3

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2008 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader