CVE Daily

CVE-2014-5284

host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable fi...

High CVSS 7.2

Overview

host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access restrictions in hosts.deny and gain root privileges by creating the temporary files before automatic IP blocking is performed.

CWE: CWE-264 Published: 2014-12-02T01:59:04.763
Risk analysis

This vulnerability is rated 🟠 HIGH.

  • CVSS: 7.2 (HIGH)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags