A vulnerability has been identified in Nortel Net Direct client for Linux, which could be exploited by malicious users to obtain elevated privileges. This issue is due to temporary files being created and manipulated insecurely via the "setPermissions()" function, which could be exploited by local attackers to execute arbitrary commands with "root" privileges when a vulnerable application is used.

Affected Products

Nortel Net Direct client for Linux versions prior to 6.0.5

Solution

Upgrade to Nortel Net Direct client for Linux version 6.0.5 :
http://www.nortelnetworks.com/cs

References

http://www.vupen.com/english/advisories/2007/0671
http://www130.nortelnetworks.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=540071

Credits

Vulnerability reported by Jon Hart

Changelog

2007-02-21 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.