CVE-2017-6516

Published: 14/03/2017 Updated: 03/10/2019

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 6.7 | Impact Score: 5.9 | Exploitability Score: 0.8

VMScore: 725

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo prior to 10-H64 for Linux and UNIX platforms could allow a local malicious user to gain elevated privileges. Parts of SysInfo require setuid-to-root access in order to access restricted system files and make restricted kernel calls. This access could be exploited by a local malicious user to gain a root shell prompt using the right combination of environment variables and command line arguments.

Vulnerable Product	Search on Vulmon	Subscribe to Product
magnicomp sysinfo

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Local Rank = ExcellentRanking include Msf::Post::File include Msf::Exploit::EXE include Msf::Exploit::FileDropper def initialize(info = {}) super(update_ ...

This Metasploit module attempts to gain root privileges on systems running MagniComp SysInfo versions prior to 10-H64 The mcsiwrapper suid executable allows loading a config file using the '--configfile' argument The 'ExecPath' config directive is used to set the executable load path This Metasploit module abuses this functionality to set the l ...

MagniComp SysInfo contains a information exposure vulnerability through debug functionality Versions SysInfo 10-H81 and above are not affected ...

MagniComp SysInfo Information Exposure [CVE-2018-7268] ====================================================== The latest version of this advisory is available at: sintonenfi/advisories/magnicomp-sysinfo-information-exposuretxt Overview -------- MagniComp SysInfo contains a information exposure vulnerability through debug functionality ...

A PoC / methodology to exploit CVE-2017-6516

CVE-2017-6516 CVE-2017-6516 is a privilege escalation vulnerability that targets the mcsiwrapper binary from MagniCorp SysInfo under version 10-H64 When this binary has the SUID bit set and is outdated, a user may execute arbitrary code as the owner of the binary - which is often root Requirements The binary mcsiwrapper must be setuid: $ ls -l mcsiwrapper -rwsr-xr-x 1 ro

CWE-20 http://www.magnicomp.com/support/cve/CVE-2017-6516.shtml http://www.securityfocus.com/bid/96934 https://labs.mwrinfosecurity.com/advisories/multiple-vulnerabilities-in-magnicomps-sysinfo-root-setuid/https://labs.mwrinfosecurity.com/advisories/magnicomps-sysinfo-root-setuid-local-privilege-escalation-vulnerability/https://www.exploit-db.com/exploits/44150/https://nvd.nist.gov https://github.com/Rubytox/CVE-2017-6516-mcsiwrapper-http://seclists.org/fulldisclosure/2018/Jun/44 https://www.exploit-db.com/exploits/44150/

CVE-2017-6516

Vulnerability Summary

Exploits

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect