PT-2022-19692 · Qualys · Qualys Cloud Agent

Bryan Li + 3 · Published 2022-08-18 · Updated 2022-09-15 · CVE-2022-29549

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Qualys Cloud Agent version 4.8.0-49

Description An issue was discovered in the Qualys Cloud Agent where it executes programs at various full pathnames without first making ownership and permission checks, and without integrity checks. This could lead to privilege escalation on systems where any of these pathnames is controlled by a non-root user. For example, if the /opt/firebird directory is owned by the firebird user, an issue could occur with the /opt/firebird/bin/isql program.

Recommendations For Qualys Cloud Agent version 4.8.0-49, consider restricting access to the directories and files that could be exploited for privilege escalation, such as /opt/firebird/bin/isql, until a patch is available. As a temporary workaround, ensure that all executable paths used by the agent are owned by root to prevent non-root users from manipulating them.

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2022-29549

Affected Products

Qualys Cloud Agent

References · 9

• https://blog.qualys.com/product-tech/2022/08/15/qualys-security-updates-cloud-agent-for-linux · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29549 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29549 · Security Note
• https://blog.qualys.com/vulnerabilities-threat-research · Vendor Advisory
• http://packetstormsecurity.com/files/168367/Qualys-Cloud-Agent-Arbitrary-Code-Execution.html · Note
• http://software.firstworks.com/p/getting-started-with-firebird.html · Note
• http://seclists.org/fulldisclosure/2022/Sep/10 · Note
• https://t.me/cvenotify/34866 · Telegram Post
• https://t.me/cvenotify/34978 · Telegram Post