MagniComp's SysInfo root setuid() Local Privilege Escalation Vulnerability

  • Published: 23 Sep 2016

MagniComp’s SysInfo root setuid() Local Privilege Escalation Vulnerability

Share

Type

  • Local Privilege Escalation

Severity

  • High

Affected products

  • MagniComp’s SysInfo

CVE Reference

  • N/A
Timeline
2016-06-23Vulnerability Discovered
2016-07-20Reported to MagniComp’s Security Team
2016-07-21Fixes Confirmed
2016-08-23Public Patch Released
2016-09-23Advisory Released

Download the advisory here

Description

MagniComp’s SysInfo enables system administrators to find and view highly detailed system, software, and hardware information on a variety of platforms.

A Local Privilege Escalation Vulnerability in MagniComp’s Sysinfo for Linux could allow a local attacker to gain elevated privileges.

Impact

This vulnerability allows local users to gain root privilege and hence full control over the affected system.

Cause

The application relies on information passed to it from the shell to see where it is installed and where to find the configuration file. Additionally, the application relies on arbitrary arguments to decide which applications to execute.

Solution

Update to the latest version.

Technical Details

Refer to attached detailed advisory above.