PT-2020-13832 · Icinga+1 · Icinga2+1

Matthias Gerstner · Published 2020-06-12 · Updated 2024-06-15 · CVE-2020-14004

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Icinga2 versions prior to 2.12.0-rc1

Description An issue was discovered where the prepare-dirs script, part of the icinga2 systemd service, executes chmod 2750 /run/icinga2/cmd. Since /run/icinga2 is under control of an unprivileged user by default, if /run/icinga2/cmd is a symlink, it will be followed, allowing arbitrary files to be changed to mode 2750 by the unprivileged icinga2 user.

Recommendations For versions prior to 2.12.0-rc1, update to version 2.12.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /run/icinga2/cmd directory to prevent the unprivileged icinga2 user from modifying arbitrary files.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2020-14004

OPENSUSE-SU-2020:1820-1

OPENSUSE-SU-2020_1820-1

OPENSUSE-SU-2024:10856-1

SUSE-SU-2022:3725-1

SUSE-SU-2022_3725-1

Affected Products

Icinga2

Suse

References · 35

• 🔥 http://openwall.com/lists/oss-security/2020/06/12/1 · Exploit
• https://github.com/Icinga/icinga2/pull/8045/commits/2f0f2e8c355b75fa4407d23f85feea037d2bc4b6 · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-14004 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00014.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14004 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10856-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14004 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14004 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3725-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14004 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14004 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1820-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-14004 · Security Note
• https://github.com/Icinga/icinga2/compare/v2.12.0-rc1...master · Note
• https://github.com/Icinga/icinga2/releases · Note