header-logo
Suggest Exploit
vendor:
N/A
by:
SecurityFocus
7.2
CVSS
HIGH
Arbitrary Command Execution
264
CWE
Product Name: N/A
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
1998

/usr/bin/suidexec Arbitrary Command Execution Vulnerability

The /usr/bin/suidexec program will execute arbitrary commands as root, as soon as just one suid root shell script can be found on the system. Invoking /usr/bin/suidexec with a program and the path to the script will execute the program with euid = 0, which is sufficient for doing arbitrary damage on the system.

Mitigation:

Ensure that all suid root shell scripts are properly secured and that only authorized users have access to them.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/94/info

/usr/bin/suidexec will execute arbitrary commands as root,
as soon as just _one_ suid root shell script can be found
on the system: Just invoke

/usr/bin/suidexec <your program> /path/to/script

- it will happily execute your program with euid = 0. This
is completely sufficient for doing arbitrary damage on the
system.

Navigation

Suggest Exploit

Services By CQR