CVE-2019-19041 Command injection in n/a
Attackers can execute arbitrary Bash scripts by modifying upgrade packages due to insufficient integrity verification in Lpar2RRD and Stor2RRD.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-19041?
CVE-2019-19041 is a high-severity command injection vulnerability in n/a, published on 17 Nov 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade package before processing it. As a result, official upgrade packages can be modified to inject an arbitrary Bash script that will be executed by the underlying system. It is possible to achieve this by modifying the values in the files.SUM file (which are used for integrity control) and injecting malicious code into the upgrade.sh file.
Weakness: CWE-78
Which versions are affected by CVE-2019-19041?
It affects 2 products.
Products include Xorur Lpar2rrd, Xorur Stor2rrd.
How do I fix CVE-2019-19041?
No fix has been published for CVE-2019-19041 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-19041 being exploited?
There is no known exploitation of CVE-2019-19041 in the wild and no public exploit code.
Sources
Also known as GHSA-6jw3-w9p9-w2qp.