PT-2017-2799 · Replibit · Replibit Backup Manager

Michael Allen · Publicado 2017-08-11 · Atualizado 2020-05-28 · CVE-2017-13707

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Replibit Backup Manager versions prior to 2017.08.04

Description The issue concerns a privilege escalation that allows attackers to gain root privileges. This is achieved through the execution of sudo commands, which can be used to access the vi program and navigate the filesystem. The vulnerability enables modification of critical files, such as /etc/passwd, potentially compromising system integrity. The issue is related to insufficient access control in the vi service of the Backup Manager script set.

Recommendations For Replibit Backup Manager versions prior to 2017.08.04, update to version 2017.08.04 or later to resolve the issue. As a temporary workaround, consider restricting access to the vi program and limiting the use of sudo commands to minimize the risk of exploitation.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-264

CWE-269

Identificadores relacionados

BDU:2017-02066

CVE-2017-13707

Produtos afetados

Replibit Backup Manager

Referências · 4

• 🔥 https://github.com/Wh1t3Rh1n0/exploits/blob/master/2017-08-25%20Replibit%20Backup%20Manager/README.md · Exploit
• https://bdu.fstec.ru/vul/2017-02066 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-13707 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-13707 · Aviso do Fabricante