Full Disclosure mailing list archives

By Date By Thread Ambari Server 1.7.0 Local Privilege Escalation From: Julian Horoszkiewicz <ewilded () gmail com>

Date: Thu, 14 May 2015 14:27:36 +0200

Title: Ambari Server 1.7.0 Local Privilege Escalation Author: Julian Horoszkiewicz Description: An issue with ambari-root privilege separation model has been identified. The reason for this is that /var/lib/ambari-server/ambari-env.sh script is by default owned by user ambari, but executed as root. That opens the way for adding arbitrary commands to be executed as root if one has access to ambari user account. The ambari server itself runs with privileges of the dedicated user ambari (it drops privileges from root), but privilege reduction takes place scarcely after execution of the culprit script, which leads to privilege escalation. Either manual service restart by root, or system reboot has to be performed in order to get the malicious code executed. In order to mitigate the risk, file ownership should be changed to root. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/ By Date By Thread Current thread: Ambari Server 1.7.0 Local Privilege Escalation Julian Horoszkiewicz (May 14)