Summary
A helper used to obtain credentials for mounting network file shares fails to securely relinquish its root privileges before it looks up user information. Because that lookup happens inside an environment the calling user controls, a local low privileged attacker can send a crafted key request payload that pushes the root owned helper into a custom namespace. The namespace supplies a malicious name service switch module along with its configuration, which the helper then loads while still holding full privileges. Loading the attacker supplied module allows arbitrary commands to run as the root user. The outcome is a complete privilege escalation and full compromise of the affected host.
Products not listed in the Impact Details section have not been evaluated. Furthermore, products that have exceeded any software maintenance time periods are also not evaluated and will not be published. Please consult End of Sale and End of Service Life - Extreme Networks for the EOL notices related to the product under question.
Products Potentially Affected
None
Impact Details
|
OS/Product
|
Exposure
|
|
ExtremeAnalytics for Site Engine
|
Yes
|
|
ExtremeCloud IQ - Site Engine (XIQ-SE)
|
Yes
|
|
ExtremeControl for Site Engine
|
Yes
|
Repair Recommendations
ExtremeAnalytics for Site Engine:
- Fixed in 26.8.10 or later.
ExtremeCloud IQ - Site Engine (XIQ-SE):
- Fixed in 26.8.10 or later.
ExtremeControl for Site Engine:
- Fixed in 26.8.10 or later.
Please see the full Security Advisory here for more details and future updates.
