VULHUB ™

Some Progress Database binaries are reportedly installed setuid root on Unix systems. It is possible for a local user to specify an arbitrary path to a configuration file via environment variables, which will be accessed with elevated privileges. If an error is encountered when opening the configuration file, the contents of the file are displayed in the error message. This could allow an unprivileged user to specify any file as the configuration file and view the contents through the Progress error message regardless of the privilege level of the target file.

Some Progress Database binaries are reportedly installed setuid root on Unix systems. It is possible for a local user to specify an arbitrary path to a configuration file via environment variables, which will be accessed with elevated privileges. If an error is encountered when opening the configuration file, the contents of the file are displayed in the error message. This could allow an unprivileged user to specify any file as the configuration file and view the contents through the Progress error message regardless of the privilege level of the target file.