Detections
Analytics
CVE-2014-5284
high
Description
host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access restrictions in hosts.deny and gain root privileges by creating the temporary files before automatic IP blocking is performed.
References
https://github.com/mbadanoiu/CVE-2014-5284
https://github.com/ossec/ossec-hids/releases/tag/2.8.1
https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-5175
http://www.exploit-db.com/exploits/35234
http://packetstormsecurity.com/files/129111/OSSEC-2.8-Privilege-Escalation.html