high7.2Public exploit code
CVE-2014-5284
host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- OSSEC 2.8 - 'hosts.deny' Local Privilege Escalation2014-11-14 · local · linux · Verified
Impact
host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access restrictions in hosts.deny and gain root privileges by creating the temporary files before automatic IP blocking is performed.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ossec | Ossec | through 2.8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/129111/OSSEC-2.8-Privilege-Escalation.html
- http://www.exploit-db.com/exploits/35234
- https://github.com/ossec/ossec-hids/releases/tag/2.8.1
- http://packetstormsecurity.com/files/129111/OSSEC-2.8-Privilege-Escalation.html
- http://www.exploit-db.com/exploits/35234
- https://github.com/ossec/ossec-hids/releases/tag/2.8.1