Информационная безопасность
[RU] switch to English


Дополнительная информация

  Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  Wordpress the-welcomizer plugin Cross-Site Scripting Vulnerabilities

  Citrix Receiver, XenDesktop "Pass-the-
hash" Attack

  0A29-11-3 : Cross-Site Scripting vulnerabilities in Nagios XI < 2011R1.9

  PHP-SCMS 1.6.8 "lang" parameter XSS vulnerability

From:0a29 40 <0a2940_(at)_gmail.com>
Date:19 декабря 2011 г.
Subject:0A29-11-4 : Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9

================
Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9

Author: 0a29406d9794e4f9b30b3c5d6702c708

twitter.com/0a29 - 0a29.blogspot.com - GMail 0a2940
================
Description:
================

Multiple privilege escalations exist within Nagios XI installer.

Tested against 2011R1.8, dated October 28, 2011. Fixes detailed in
http://assets.nagios.com/downloads/nagiosxi/CHANGES-2011.TXT (2011R1.9
- 12/07/2011)

================
Details:
================

Vulnerability 1: Arbitrary RPM installation
-----
Files:
       0-yum
       1-prereqs

In certain situations files matching /tmp/epel-release*.rpm ,
/tmp/rpmforge-release*.rpm
and /tmp/php-pear-HTML-Template-IT*.rpm will be installed.

e.g. from 0-yum:

if ! rpm -q epel-release &>/dev/null; then
       <snip>
               cd /tmp
       <snip>
               rpm -Uvh epel-release*.rpm
-----

Vulnerability 2: Arbitrary crontab intallation
-----
Files:
       install-crontab-root
       install-crontab-nagios
       uninstall-crontab-nagios

A malicious user can exploit a race condition to control the root and
nagios user's
crontab. By creating the temporary file in advance (to control
permissions) an attacker
can insert entries before it is used to update the crontab.

e.g. from install-crontab-root:
---
#!/bin/sh

crontab -l -u root | grep -v "/usr/local/nagiosxi/" > /tmp/root.crontab.new
cat nagiosxi/crontab.root >> /tmp/root.crontab.new

crontab -u root /tmp/root.crontab.new

rm -f /tmp/root.crontab.new

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород