CVE-2016-4445
HighSummary
The fix_lookup_id function in sealert in setroubleshoot before version 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name.
Risk Assessment
This vulnerability may lead to unauthorized access to the system with administrator privileges, posing a serious security threat to the organization.
Recommendation
It is recommended to update setroubleshoot to version 3.2.23 or later to mitigate this vulnerability.
Other vulnerabilities in setroubleshoot
See all- CVE-2016-4989High
The vulnerability in setroubleshoot allows local users to bypass the intended container protection mechanism and execute arbitrary commands. This can be achieved by triggering an SELinux denial using a crafted file name or crafted fields in an XML document.
- CVE-2016-4444High
The allow_execmod plugin for setroubleshoot before version 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a crafted binary filename.
- CVE-2015-1815High
The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before version 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name.
Original NVD description (English source)
The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name, related to executing external commands with the commands.getstatusoutput function.