CVE-2012-10022: falha de alta gravidade em LxCenter Kloxo
Kloxo <= 6.1.12 Local Privilege Escalation
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
36Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 8.5epss 0.5%
da publicação à armano mesmo dia
Publicada no NVD1 de ago.
metasploit18 de set.
Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user matches uid 48. This flaw enables attackers with Apache-level access to escalate privileges to root without authentication.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
LxCenter · KloxoReferências
https://github.com/KloxoNGCommunity/kloxohttps://kloxo.org/https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/kloxo_lxsuexec.rbhttps://web.archive.org/web/20121122063935/http://roothackers.net/showthread.php?tid=92https://www.exploit-db.com/exploits/25406https://www.vulncheck.com/advisories/kloxo-local-priv-esc