CVE-2014-0243: Medium severity checkmk vulnerability
CheckMK through 1.2.5i2p1 allows local users to read arbitrary files via a symlink attack to a file in /var/lib/checkmkagent/job.
Other sources
LSE Leading Security Experts GmbH discovered that the CheckMK agent (Nagios plugin) processed files from the /var/lib/checkmkagent/job directory which had 1777 permissions. The mk-job program did not check whether any files in this directory where symbolic or hard links. Due to the permissions of this directory, any user could add a symbolic or hard link to any file on the filesystem, and because the CheckMK agent ran as the root user, it could expose arbitrary files via the agent, which exposes all the contents of this directory on TCP port 6556 by default.
This can be worked-around by setting mode 0755 on /var/lib/checkmkagent/job (removing the sticky bit).
This is described in the upstream bug report [1] and fixed in git [2].
[1] http://mathias-kettner.com/checkmkwerks.php?werkid=978 [2] http://git.mathias-kettner.de/git/?p=checkmk.git;a=commit;h=a2ef8d00c53ec9cbd05c4ae2f09b50761130e7ce
Acknowledgements:
Red Hat would like to thank LSE Leading Security Experts GmbH for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0243?
CVE-2014-0243 is considered a moderate severity vulnerability due to the potential for local users to read arbitrary files.
How do I fix CVE-2014-0243?
To fix CVE-2014-0243, upgrade to a version of Check_MK that is later than 1.2.5i2p1.
Who discovered CVE-2014-0243?
CVE-2014-0243 was discovered by LSE Leading Security Experts GmbH.
What type of attack is associated with CVE-2014-0243?
CVE-2014-0243 is associated with a symlink attack.
Which versions of Check_MK are affected by CVE-2014-0243?
CVE-2014-0243 affects Check_MK versions up to and including 1.2.5i2p1.