Wednesday, 14 December 2011

0A29-11-4 : Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9

Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9

Author: 0a29406d9794e4f9b30b3c5d6702c708 - - GMail 0a2940

Multiple privilege escalations exist within Nagios XI installer.

Tested against 2011R1.8, dated October 28, 2011. Fixes detailed in (2011R1.9 - 12/07/2011)


16 November 2011 - Reported to Nagios Enterprises
16 November 2011 - Acknowledged
13 December 2011 - Nagios XI 2011R1.9 released
14 December 2011 - Nagios Enterprises report fixed
14 December 2011 - Public disclosure


Vulnerability 1: Arbitrary RPM installation

In certain situations files matching /tmp/epel-release*.rpm , /tmp/rpmforge-release*.rpm
 and /tmp/php-pear-HTML-Template-IT*.rpm will be installed.

e.g. from e0-yum:

if ! rpm -q epel-release &>/dev/null; then
                cd /tmp
        rpm -Uvh epel-release*.rpm

Vulnerability 2: Arbitrary crontab intallation

A malicious user can exploit a race condition to control the root and nagios user's
crontab. By creating the temporary file in advance (to control permissions) an attacker
can insert entries before it is used to update the crontab.

e.g. from install-crontab-root:

crontab -l -u root | grep -v "/usr/local/nagiosxi/" > /tmp/
cat nagiosxi/crontab.root >> /tmp/

crontab -u root /tmp/

rm -f /tmp/

No comments:

Post a Comment

Note: only a member of this blog may post a comment.