PT-2019-6656 · Kt · Ktsuss

Publicado 2019-11-19 · Atualizado 2019-11-21 · CVE-2011-2921

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ktsuss versions 1.4 and prior

Description The issue allows for command execution with root privileges due to the uid being set to root and privileges not being dropped before executing user-specified commands.

Recommendations For versions 1.4 and prior, consider dropping privileges before executing user-specified commands to prevent command execution with root privileges. As a temporary workaround, restrict the use of ktsuss to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-273

Identificadores relacionados

CVE-2011-2921

Produtos afetados

Ktsuss

Referências · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/ktsuss_suid_priv_esc.rb · Exploit
• 🔥 https://exploit-db.com/exploits/47344 · Exploit
• 🔥 http://packetstormsecurity.com/files/154307/ktsuss-Suid-Privilege-Escalation.html · Exploit
• https://access.redhat.com/security/cve/cve-2011-2921 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-2921 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2011-2921 · Aviso do Fabricante