本文共 1421 字，大约阅读时间需要 4 分钟。
================Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9Author: 0a29406d9794e4f9b30b3c5d6702c708twitter.com/0a29 - 0a29.blogspot.com - GMail 0a2940================Description:================Multiple privilege escalations exist within Nagios XI installer.Tested against 2011R1.8, dated October 28, 2011. Fixes detailed inhttp://assets.nagios.com/downloads/nagiosxi/CHANGES-2011.TXT (2011R1.9- 12/07/2011)================Details:================Vulnerability 1: Arbitrary RPM installation-----Files: 0-yum 1-prereqsIn certain situations files matching /tmp/epel-release*.rpm ,/tmp/rpmforge-release*.rpm and /tmp/php-pear-HTML-Template-IT*.rpm will be installed.e.g. from 0-yum:if ! rpm -q epel-release &>/dev/null; thencd /tmp rpm -Uvh epel-release*.rpm-----Vulnerability 2: Arbitrary crontab intallation-----Files: install-crontab-root install-crontab-nagios uninstall-crontab-nagiosA malicious user can exploit a race condition to control the root andnagios user'scrontab. By creating the temporary file in advance (to controlpermissions) an attackercan insert entries before it is used to update the crontab.e.g. from install-crontab-root:---#!/bin/shcrontab -l -u root | grep -v "/usr/local/nagiosxi/" > /tmp/root.crontab.newcat nagiosxi/crontab.root >> /tmp/root.crontab.newcrontab -u root /tmp/root.crontab.newrm -f /tmp/root.crontab.new
转载地址：http://xjhmb.baihongyu.com/