CVE-2017-6516 : A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo before 10-H64

A Local Privilege Escalation Vulnerability in MagniComp's Sysinfo before 10-H64 for Linux and UNIX platforms could allow a local attacker to gain elevated privileges. Parts of SysInfo require setuid-to-root access in order to access restricted system files and make restricted kernel calls. This access could be exploited by a local attacker to gain a root shell prompt using the right combination of environment variables and command line arguments.

Published 2017-03-14 17:59:00

Updated 2019-10-03 00:03:26

Source MITRE

View at NVD, CVE.org

Vulnerability category: Input validationGain privilege

Products affected by CVE-2017-6516

Magnicomp » Sysinfo
Versions up to, including, (<=) 10-h62
cpe:2.3:a:magnicomp:sysinfo:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-6516

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 36 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2017-6516

MagniComp SysInfo mcsiwrapper Privilege Escalation

Disclosure Date: 2016-09-23

First seen: 2020-04-26

exploit/multi/local/magnicomp_sysinfo_mcsiwrapper_priv_esc

This module attempts to gain root privileges on systems running MagniComp SysInfo versions prior to 10-H64. The .mcsiwrapper suid executable allows loading a config file using the '--configfile' argument. The 'ExecPath' config directive is used to set

More information

CVSS scores for CVE-2017-6516

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
6.7	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-6516

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-6516

http://www.magnicomp.com/support/cve/CVE-2017-6516.shtml

Security Vulnerability Notice - CVE-2017-6516
Third Party Advisory
https://labs.mwrinfosecurity.com/advisories/multiple-vulnerabilities-in-magnicomps-sysinfo-root-setuid/

Multiple Vulnerabilities in MagniComp's SysInfo root setuid()
Third Party Advisory
http://www.securityfocus.com/bid/96934

MagniComp Sysinfo CVE-2017-6516 Local Privilege Escalation Vulnerability
Third Party Advisory;VDB Entry
https://labs.mwrinfosecurity.com/advisories/magnicomps-sysinfo-root-setuid-local-privilege-escalation-vulnerability/

MagniComp's SysInfo root setuid() Local Privilege Escalation Vulnerability
Third Party Advisory
https://www.exploit-db.com/exploits/44150/

MagniComp SysInfo - mcsiwrapper Privilege Escalation (Metasploit)

Jump to