Nagios XI Privilege Escalation

`================  
Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9  
  
Author: 0a29406d9794e4f9b30b3c5d6702c708  
  
twitter.com/0a29 - 0a29.blogspot.com - GMail 0a2940  
================  
Description:  
================  
  
Multiple privilege escalations exist within Nagios XI installer.  
  
Tested against 2011R1.8, dated October 28, 2011. Fixes detailed in  
http://assets.nagios.com/downloads/nagiosxi/CHANGES-2011.TXT (2011R1.9  
- 12/07/2011)  
  
================  
Details:  
================  
  
Vulnerability 1: Arbitrary RPM installation  
-----  
Files:  
0-yum  
1-prereqs  
  
In certain situations files matching /tmp/epel-release*.rpm ,  
/tmp/rpmforge-release*.rpm  
and /tmp/php-pear-HTML-Template-IT*.rpm will be installed.  
  
e.g. from 0-yum:  
  
if ! rpm -q epel-release &>/dev/null; then  
<snip>  
cd /tmp  
<snip>  
rpm -Uvh epel-release*.rpm  
-----  
  
Vulnerability 2: Arbitrary crontab intallation  
-----  
Files:  
install-crontab-root  
install-crontab-nagios  
uninstall-crontab-nagios  
  
A malicious user can exploit a race condition to control the root and  
nagios user's  
crontab. By creating the temporary file in advance (to control  
permissions) an attacker  
can insert entries before it is used to update the crontab.  
  
e.g. from install-crontab-root:  
---  
#!/bin/sh  
  
crontab -l -u root | grep -v "/usr/local/nagiosxi/" > /tmp/root.crontab.new  
cat nagiosxi/crontab.root >> /tmp/root.crontab.new  
  
crontab -u root /tmp/root.crontab.new  
  
rm -f /tmp/root.crontab.new  
`