Time-of-Check to Time-of-Use Race Condition in SafeNet Authentication Client

Executive Summary

This vulnerability is a time-of-check to time-of-use (TOCTOU) race condition in the SafeNet Authentication Client (SAC) SACSrv log-cleanup function. It allows an authenticated, non-administrator local user to redirect a privileged file deletion operation outside the intended log directory.

Useful 0 Not Useful 0

Detection Guidance

Detection requires checking for unauthorized file deletions or suspicious log-cleanup operations in the SafeNet Authentication Client (SAC) service. Monitor logs for unexpected file access patterns or deletions outside the intended directory. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete critical files outside the log directory, potentially causing system instability or unauthorized data loss. This requires local access and authentication but no admin privileges.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the SafeNet Authentication Client (SAC) to a version beyond 10.9 R3 GA (build 10.9.7449). Apply patches or updates from Thales as soon as they are available to address the race condition in the log-cleanup function.

Useful 0 Not Useful 0