CVE-2019-11660
published 2019-09-13CVE-2019-11660: Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. This vulnerability could be…
PriorityP355high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EXPLOIT
EPSS
7.85%
93.9th percentile
Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. This vulnerability could be exploited by a low-privileged user to execute a custom binary with higher privileges.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microfocus | data_protector | — | — |
| microfocus | data_protector | 10.00 – 10.04 | — |
| microfocus | data_protector | 10.10 – 10.40 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for execution of the SUID binary `omniresolve` with a manipulated PATH environment variable (PATH containing /tmp or other writable directories prepended), which is the core exploit primitive. ↗
- →Alert on creation of a file named `oracleasm` in world-writable directories (e.g. /tmp) followed by execution of `/opt/omni/lbin/omniresolve`, indicating PATH hijacking of the trusted SUID binary. ↗
- →Detect privilege escalation by checking if processes spawned by `/opt/omni/lbin/omniresolve` run as root while the parent process is a low-privileged user; the binary is SUID and should be audited for unexpected child processes. ↗
- →Flag vulnerable builds of omniresolve: internal build 118 or lower (e.g. build 110, build 118) are exploitable; patched build is 125 or higher. Use `omniresolve -ver` output to identify vulnerable instances. ↗
- ·The exploit requires an existing low-privileged shell or Meterpreter session on the target; it is a local privilege escalation, not a remote exploit. ↗
- ·The writable directory (default /tmp) must be writable by the attacker's session for the payload drop and PATH hijack to succeed. ↗
- ·The vulnerability is patched in Micro Focus Data Protector A.10.40 OMNIRESOLVE internal build 125; builds at or below 118 on version 10.40 (and all prior versions) remain vulnerable. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Micro Focus (HPE) Data Protector - SUID Privilege Escalation (Metasploit)
exploitdb·2019-11-04
CVE-2019-11660 Micro Focus (HPE) Data Protector - SUID Privilege Escalation (Metasploit)
Micro Focus (HPE) Data Protector - SUID Privilege Escalation (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Micro Focus (HPE) Data Protector SUID Privilege Escalation',
'Description' => %q{
This module exploits the trusted `$PATH` environment
variable of the SUID binary `omniresolve` in
Micro Focus (HPE) Data Protector A.10.40 and prior.
The `omniresolve` executable calls the `oracleasm` binary using
a relative path and the trusted environment `$PATH`, which allows
an attacker to execute a custom binary with `root` privileges.
This module has been successfully tested on:
HPE Data Protector A.09.07: OMNIRESOLVE, internal build 110, built on Thu Aug 11 14:5
Metasploit
Micro Focus (HPE) Data Protector SUID Privilege Escalation
metasploit
Micro Focus (HPE) Data Protector SUID Privilege Escalation
Micro Focus (HPE) Data Protector SUID Privilege Escalation
This module exploits the trusted `$PATH` environment variable of the SUID binary `omniresolve` in Micro Focus (HPE) Data Protector A.10.40 and prior. The `omniresolve` executable calls the `oracleasm` binary using a relative path and the trusted environment `$PATH`, which allows an attacker to execute a custom binary with `root` privileges. This module has been successfully tested on: HPE Data Protector A.09.07: OMNIRESOLVE, internal build 110, built on Thu Aug 11 14:52:38 2016; Micro Focus Data Protector A.10.40: OMNIRESOLVE, internal build 118, built on Tue May 21 05:49:04 2019 on CentOS Linux release 7.6.1810 (Core) The vulnerability has been patched in: Micro Focus Data Protector A.10.40: OMNIRESOLVE, internal build 125, built
No writeups or analysis indexed.
http://packetstormsecurity.com/files/155076/Micro-Focus-HPE-Data-Protector-SUID-Privilege-Escalation.htmlhttps://softwaresupport.softwaregrp.com/doc/KM03525630http://packetstormsecurity.com/files/155076/Micro-Focus-HPE-Data-Protector-SUID-Privilege-Escalation.htmlhttps://softwaresupport.softwaregrp.com/doc/KM03525630
2019-09-13
Published