Michael Orlitzky

A vulnerabilidade permite a escalada de privilégios do usuário nagios para root, pois determinados arquivos executáveis pertencem ao usuário nagios.

Os recursos de plotagem do software afetado utilizam nomes previsíveis no diretório /tmp, permitindo que um invasor local controle o conteúdo criando arquivos antecipadamente com esses nomes. Esse problema afeta, por exemplo, o plot2d.

O problema decorre do `pkg postinst` no ebuild do Gentoo para o Slurm, que chama desnecessariamente o `chown` para atribuir a propriedade do root aos arquivos no sistema de arquivos raiz ativo. Isso poderia ser explorado pelo usuário `slurm` para se tornar o proprietário de arquivos pertencentes ao root.

The issue allows local users with access to the uptimed user account to gain root privileges. This is achieved by creating a hard link within the /var/spool/uptimed directory, taking advantage of an unsafe chown -R call.

A vulnerabilidade permite que o usuário `smokeping` provoque uma negação de serviço em PIDs arbitrários quando o serviço é interrompido, escrevendo PIDs arbitrários no arquivo PID utilizado pelo script de inicialização.

O script de inicialização no pacote ebuild do SmokePing no Gentoo permite que o usuário smokeping obtenha propriedade sobre qualquer arquivo, o que pode levar à obtenção de privilégios de root por parte do usuário smokeping. Esta vulnerabilidade envolve uma condição de corrida relacionada a `/var/lib/smokeping` e ao comando `chown`.

A vulnerabilidade permite a escalada de privilégios de root a partir do usuário logcheck devido a chamadas recursivas inseguras do comando `chown` no pacote ebuild do Logcheck no Gentoo.

A vulnerabilidade permite que usuários locais insiram um plugin de cavalo de Tróia no diretório /usr/lib64/nagios/plugins, aproveitando o acesso à conta de usuário nagios. Isso é possível porque o diretório fica gravável entre uma chamada ao `emake` e uma chamada ao `fowners`.

The issue allows local users to gain access to an arbitrary user's account. This is because the parent directory of the user-profile directories is world writable.

The issue allows local users with access to the man user account to gain root privileges because /usr/bin/mandb is executed by root but not owned by root. Additionally, the owner can strip the setuid and setgid bits.

Name of the Vulnerable Software and Affected Versions: burp versions prior to 2.1.32 Description: The issue allows local users to potentially kill arbitrary processes by modifying the PID file before a root script sends a SIGKILL signal, leveraging access to the burp account. Recommendations: For versions prior to 2.1.32, update to version 2.1.32 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: burp versions prior to 2.1.32 Description: The issue is related to incorrect group ownership of the /etc/burp directory, potentially allowing local users to gain read and write access to arbitrary files by modifying the burp-server.conf file. Recommendations: For versions prior to 2.1.32, update to version 2.1.32 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: collectd versions prior to 5.7.2-r1 Description: The issue allows local users to potentially kill arbitrary processes by modifying PID files, leveraging access to the collectd account before a root script sends a SIGKILL when the service is stopped. Recommendations: For versions prior to 5.7.2-r1, update to version 5.7.2-r1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: jabberd2 versions prior to 2.6.1 Description: The issue allows local users to potentially kill arbitrary processes by modifying PID files. This is possible because the ownership of /var/run/jabber is set to the jabber account, which can be leveraged to modify PID files before a root script executes a command to kill processes based on the contents of these files. Recommendations: For versions prior to 2.6.1, consider restricting access to the /var/run/jabber directory to prevent unauthorized modification of PID files until a fix is available. As a temporary workaround, ensure that only trusted users have access to the jabber account to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Gentoo net-im/jabberd2 versions through 2.6.1 Description: The issue allows local users to potentially gain privileges by leveraging access to the jabber account and waiting for root to execute one of the installed programs, including jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s, and jabberd2-sm. Recommendations: For Gentoo net-im/jabberd2 versions through 2.6.1, consider changing the ownership of the installed programs from the jabber account to a more secure account to prevent local users from gaining privileges.

Name of the Vulnerable Software and Affected Versions: systemd versions prior to 237 Description: The issue is related to incorrect link resolution before file access in the systemd-tmpfiles daemon, allowing an attacker to bypass existing access restrictions and potentially disclose protected information. This can occur when the fs.protected hardlinks setting is disabled by an administrator and an attacker creates hard links to sensitive files. Local users can exploit this to change ownership or permissions of files they normally cannot access, such as the /etc/passwd file. Recommendations: For versions prior to 237, update to version 237 or later to resolve the issue. As a temporary workaround, consider enabling the fs.protected hardlinks sysctl to prevent the creation of hard links to sensitive files.

Name of the Vulnerable Software and Affected Versions: GNU Coreutils versions prior to 8.30 Description: The issue allows local users to modify the ownership of arbitrary files by leveraging a race condition when using the POSIX "-R -L" options in chown and chgrp. This occurs because chown-core.c does not prevent replacement of a plain file with a symlink. Recommendations: For GNU Coreutils versions prior to 8.30, update to version 8.30 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the POSIX "-R -L" options in chown and chgrp until the update is applied.

The issue allows local users to gain privileges by leveraging access to the assp user account. This can be achieved by installing a Trojan horse /usr/share/assp/assp.pl script.

The issue may allow members of the "qemu" group to gain root privileges by creating a hard link in a directory on which "chown" is called recursively by the OpenRC service script.

The issue allows local users to gain privileges by leveraging access to the mysql account for creation of a link, due to chown calls for user-writable directory trees in the installation scripts.