================
Privilege escalation vulnerabilities in Nagios XI installer < 2011R1.9
Author: 0a29406d9794e4f9b30b3c5d6702c708
Multiple privilege escalations exist within Nagios XI installer.
Tested against 2011R1.8, dated October 28, 2011. Fixes detailed in
http://assets.nagios.com/downloads/nagiosxi/CHANGES-2011.TXT (2011R1.9
Files:
0-yum
1-prereqs
In certain situations files matching /tmp/epel-release*.rpm ,
/tmp/rpmforge-release*.rpm
and /tmp/php-pear-HTML-Template-IT*.rpm will be installed.
e.g. from 0-yum:
Files:
install-crontab-root
install-crontab-nagios
uninstall-crontab-nagios
A malicious user can exploit a race condition to control the root and
nagios user's
crontab. By creating the temporary file in advance (to control
permissions) an attacker
can insert entries before it is used to update the crontab.
#!/bin/sh
crontab -l -u root | grep -v "/usr/local/nagiosxi/" > /tmp/root.crontab.new
cat nagiosxi/crontab.root >> /tmp/root.crontab.new
crontab -u root /tmp/root.crontab.new
rm -f /tmp/root.crontab.new