CVE-2014-5284 host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access restrictions in hosts.deny and gain root....
HighCVSS 7.2
EPSS 2.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access restrictions in hosts.deny and gain root privileges by creating the temporary files before automatic IP blocking is performed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ossec | <= 2.8.0 | No fix listed |
References
- packetstormsecurity.com exploit
- 35234 exploit
- github.com patch vendor-advisory