PT-2019-15767 · Xorux+1 · Xorux Lpar2Rrd+3

Gatien Goteni · Publicado 2019-11-17 · Atualizado 2019-11-19 · CVE-2019-19041

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Xorux Lpar2RRD versions 6.11 Stor2RRD versions 2.61 Xorux version 2.41

Description An issue was discovered where the integrity of an upgrade package is not correctly verified before processing. This allows official upgrade packages to be modified, enabling the injection of an arbitrary Bash script that will be executed by the system. The modification can be achieved by altering values in the files.SUM file and injecting malicious code into the upgrade.sh file.

Recommendations For Xorux Lpar2RRD version 6.11, consider disabling the upgrade functionality until a patch is available. For Stor2RRD version 2.61, restrict access to the upgrade.sh file to minimize the risk of exploitation. For Xorux version 2.41, avoid using the modified files.SUM file for integrity control until the issue is resolved.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2019-19041

Produtos afetados

Bash

Stor2Rrd

Xorux

Xorux Lpar2Rrd

Referências · 3

• 🔥 https://github.com/gotenigatien/Xorux-critical-vulnerability/blob/master/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-19041 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-19041 · Aviso do Fabricante