0A29-11-4 : Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9

================
Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9

Author: 0a29406d9794e4f9b30b3c5d6702c708

twitter.com/0a29 - 0a29.blogspot.com - GMail 0a2940
================
Description:
================

Multiple privilege escalations exist within Nagios XI installer.

Tested against 2011R1.8, dated October 28, 2011. Fixes detailed in
http://assets.nagios.com/downloads/nagiosxi/CHANGES-2011.TXT (2011R1.9 - 12/07/2011)

================
Timeline:
================

16 November 2011 - Reported to Nagios Enterprises
16 November 2011 - Acknowledged
13 December 2011 - Nagios XI 2011R1.9 released
14 December 2011 - Nagios Enterprises report fixed
14 December 2011 - Public disclosure

================
Details:
================

Vulnerability 1: Arbitrary RPM installation
-----
Files:
    0-yum
    1-prereqs

In certain situations files matching /tmp/epel-release*.rpm , /tmp/rpmforge-release*.rpm
 and /tmp/php-pear-HTML-Template-IT*.rpm will be installed.

e.g. from e0-yum:

if ! rpm -q epel-release &>/dev/null; then
        <snip>
                cd /tmp
        <snip>      
        rpm -Uvh epel-release*.rpm
-----

Vulnerability 2: Arbitrary crontab intallation
-----
Files:
    install-crontab-root
    install-crontab-nagios
    uninstall-crontab-nagios

A malicious user can exploit a race condition to control the root and nagios user's
crontab. By creating the temporary file in advance (to control permissions) an attacker
can insert entries before it is used to update the crontab.

e.g. from install-crontab-root:
---
#!/bin/sh

crontab -l -u root | grep -v "/usr/local/nagiosxi/" > /tmp/root.crontab.new
cat nagiosxi/crontab.root >> /tmp/root.crontab.new

crontab -u root /tmp/root.crontab.new

rm -f /tmp/root.crontab.new