lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CALX_EUQeMPH7ULCGhEfQ71rqdS48gOibGWcqsbVLkrzvMDkd_A@mail.gmail.com> Date: Wed, 14 Dec 2011 18:22:12 +0000 From: 0a29 40 <0a2940@...il.com> To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com Subject: 0A29-11-4 : Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9 ================ Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9 Author: 0a29406d9794e4f9b30b3c5d6702c708 twitter.com/0a29 - 0a29.blogspot.com - GMail 0a2940 ================ Description: ================ Multiple privilege escalations exist within Nagios XI installer. Tested against 2011R1.8, dated October 28, 2011. Fixes detailed in http://assets.nagios.com/downloads/nagiosxi/CHANGES-2011.TXT (2011R1.9 - 12/07/2011) ================ Details: ================ Vulnerability 1: Arbitrary RPM installation ----- Files: 0-yum 1-prereqs In certain situations files matching /tmp/epel-release*.rpm , /tmp/rpmforge-release*.rpm and /tmp/php-pear-HTML-Template-IT*.rpm will be installed. e.g. from 0-yum: if ! rpm -q epel-release &>/dev/null; then <snip> cd /tmp <snip> rpm -Uvh epel-release*.rpm ----- Vulnerability 2: Arbitrary crontab intallation ----- Files: install-crontab-root install-crontab-nagios uninstall-crontab-nagios A malicious user can exploit a race condition to control the root and nagios user's crontab. By creating the temporary file in advance (to control permissions) an attacker can insert entries before it is used to update the crontab. e.g. from install-crontab-root: --- #!/bin/sh crontab -l -u root | grep -v "/usr/local/nagiosxi/" > /tmp/root.crontab.new cat nagiosxi/crontab.root >> /tmp/root.crontab.new crontab -u root /tmp/root.crontab.new rm -f /tmp/root.crontab.new _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists