Trendmicro IWSS 3.1 Privilege Escalation

Posted on 27 October 2011

A vulnerability was found in the software IWSS of TrendMicro that could allow an attacker to gain root access in the system. The binary "patchCmd" has sticky permissions for the "setuid" and "setgid" with the user root. The execution is allowed to all users. The code performs a setuid(0) before an a system() by that the execution will take root permissions regardless of user permissions.