0A29-11-4 : Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9

2011-12-19T00:00:00
ID SECURITYVULNS:DOC:27459
Type securityvulns
Reporter Securityvulns
Modified 2011-12-19T00:00:00

Description

================ Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9

Author: 0a29406d9794e4f9b30b3c5d6702c708

twitter.com/0a29 - 0a29.blogspot.com - GMail 0a2940

Description:

Multiple privilege escalations exist within Nagios XI installer.

Tested against 2011R1.8, dated October 28, 2011. Fixes detailed in http://assets.nagios.com/downloads/nagiosxi/CHANGES-2011.TXT (2011R1.9 - 12/07/2011)

================ Details: ================

Vulnerability 1: Arbitrary RPM installation

Files: 0-yum 1-prereqs

In certain situations files matching /tmp/epel-release.rpm , /tmp/rpmforge-release.rpm and /tmp/php-pear-HTML-Template-IT*.rpm will be installed.

e.g. from 0-yum:

if ! rpm -q epel-release &>/dev/null; then <snip> cd /tmp <snip> rpm -Uvh epel-release*.rpm


Vulnerability 2: Arbitrary crontab intallation

Files: install-crontab-root install-crontab-nagios uninstall-crontab-nagios

A malicious user can exploit a race condition to control the root and nagios user's crontab. By creating the temporary file in advance (to control permissions) an attacker can insert entries before it is used to update the crontab.

e.g. from install-crontab-root:

!/bin/sh

crontab -l -u root | grep -v "/usr/local/nagiosxi/" > /tmp/root.crontab.new cat nagiosxi/crontab.root >> /tmp/root.crontab.new

crontab -u root /tmp/root.crontab.new

rm -f /tmp/root.crontab.new