{"id": "SECURITYVULNS:DOC:27459", "bulletinFamily": "software", "title": "0A29-11-4 : Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9", "description": "================\r\nPrivilege escalation vulnerabilities in Nagios XI installer < 2011R1.9\r\n\r\nAuthor: 0a29406d9794e4f9b30b3c5d6702c708\r\n\r\ntwitter.com/0a29 - 0a29.blogspot.com - GMail 0a2940\r\n================\r\nDescription:\r\n================\r\n\r\nMultiple privilege escalations exist within Nagios XI installer.\r\n\r\nTested against 2011R1.8, dated October 28, 2011. Fixes detailed in\r\nhttp://assets.nagios.com/downloads/nagiosxi/CHANGES-2011.TXT (2011R1.9\r\n- 12/07/2011)\r\n\r\n================\r\nDetails:\r\n================\r\n\r\nVulnerability 1: Arbitrary RPM installation\r\n-----\r\nFiles:\r\n 0-yum\r\n 1-prereqs\r\n\r\nIn certain situations files matching /tmp/epel-release*.rpm ,\r\n/tmp/rpmforge-release*.rpm\r\n and /tmp/php-pear-HTML-Template-IT*.rpm will be installed.\r\n\r\ne.g. from 0-yum:\r\n\r\nif ! rpm -q epel-release &>/dev/null; then\r\n <snip>\r\n cd /tmp\r\n <snip>\r\n rpm -Uvh epel-release*.rpm\r\n-----\r\n\r\nVulnerability 2: Arbitrary crontab intallation\r\n-----\r\nFiles:\r\n install-crontab-root\r\n install-crontab-nagios\r\n uninstall-crontab-nagios\r\n\r\nA malicious user can exploit a race condition to control the root and\r\nnagios user's\r\ncrontab. By creating the temporary file in advance (to control\r\npermissions) an attacker\r\ncan insert entries before it is used to update the crontab.\r\n\r\ne.g. from install-crontab-root:\r\n---\r\n#!/bin/sh\r\n\r\ncrontab -l -u root | grep -v "/usr/local/nagiosxi/" > /tmp/root.crontab.new\r\ncat nagiosxi/crontab.root >> /tmp/root.crontab.new\r\n\r\ncrontab -u root /tmp/root.crontab.new\r\n\r\nrm -f /tmp/root.crontab.new\r\n", "published": "2011-12-19T00:00:00", "modified": "2011-12-19T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:27459", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:43", "edition": 1, "viewCount": 65, "enchantments": {"score": {"value": 3.1, "vector": "NONE"}, "dependencies": {"references": []}, "backreferences": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:12098"]}]}, "exploitation": null, "vulnersScore": 3.1}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1647589307, "score": 0}}

{}