PT-2019-15767 · Xorux+1 · Xorux Lpar2Rrd+3

Gatien Goteni · Published 2019-11-17 · Updated 2019-11-19 · CVE-2019-19041

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Xorux Lpar2RRD versions 6.11 Stor2RRD versions 2.61 Xorux version 2.41

Description An issue was discovered where the integrity of an upgrade package is not correctly verified before processing. This allows official upgrade packages to be modified, enabling the injection of an arbitrary Bash script that will be executed by the system. The modification can be achieved by altering values in the files.SUM file and injecting malicious code into the upgrade.sh file.

Recommendations For Xorux Lpar2RRD version 6.11, consider disabling the upgrade functionality until a patch is available. For Stor2RRD version 2.61, restrict access to the upgrade.sh file to minimize the risk of exploitation. For Xorux version 2.41, avoid using the modified files.SUM file for integrity control until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-19041

Affected Products

Bash

Stor2Rrd

Xorux

Xorux Lpar2Rrd

References · 3

• 🔥 https://github.com/gotenigatien/Xorux-critical-vulnerability/blob/master/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-19041 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19041 · Vendor Advisory