A vulnerability in chkrootkit may allow local users to gain root privileges.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201709-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: chkrootkit: Local privilege escalation Date: September 17, 2017 Bugs: #512356 ID: 201709-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability in chkrootkit may allow local users to gain root privileges. Background ========= chkrootkit is a tool to locally check for signs of a rootkit. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-forensics/chkrootkit < 0.50 > = 0.50 Description ========== When /tmp is mounted without the noexec option chkrootkit will execute files in /tmp with root privileges. Impact ===== A local attacker could possibly execute arbitrary code with root privileges. Workaround ========= Users should mount /tmp with noexec option. Resolution ========= All chkrootkit users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-forensics/chkrootkit-0.50" References ========= [ 1 ] CVE-2014-0476 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0476 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201709-05 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is ofutmost importance to us. Any security concerns should be addressed to
chkrootkit could be made to run programs as an administrator.. =========================================================================Ubuntu Security Notice USN-2230-1 June 04, 2014 chkrootkit vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS - Ubuntu 13.10 - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: chkrootkit could be made to run programs as an administrator. Software Description: - chkrootkit: rootkit detector Details: Thomas Stangner discovered that chkrootkit incorrectly quoted certain values. A local attacker could use this issue to execute arbitrary code when chkrootkit is run and gain root privileges. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: chkrootkit 0.49-4.1ubuntu1.14.04.1 Ubuntu 13.10: chkrootkit 0.49-4.1ubuntu1.13.10.1 Ubuntu 12.04 LTS: chkrootkit 0.49-4ubuntu1.1 Ubuntu 10.04 LTS: chkrootkit 0.49-3ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-2230-1 CVE-2014-0476 Package Information: https://launchpad.net/ubuntu/+source/chkrootkit/0.49-4.1ubuntu1.14.04.1 https://launchpad.net/ubuntu/+source/chkrootkit/0.49-4.1ubuntu1.13.10.1 https://launchpad.net/ubuntu/+source/chkrootkit/0.49-4ubuntu1.1 https://launchpad.net/ubuntu/+source/chkrootkit/0.49-3ubuntu0.1 . Ubuntu Security Advisory USN-2265-1 highlights an issue in the sudo package that permits unauthorized privilege escalation for local users through a vulnerability.. chkrootkit, rootkit detection, admin access risk. . Severity: Critical. LinuxSecurity.com Team
Thomas Stangner discovered a vulnerability in chkrootkit, a rootkit detector, which may allow local attackers to gain root access when /tmp is mounted without the noexec option. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2945-1
Get the latest Linux and open source security news straight to your inbox.