CVE-2014-5284
OSSEC < 2.8.0 - Privilege Escalation via Predictable Temporary File Handling
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2014-5284. PoCs published by skynet-13, mbadanoiu.
AI-analyzed exploit summary This exploit leverages a race condition in ossec 2.8's insecure temporary file creation to escalate privileges. It monitors /tmp for file changes and injects a malicious entry into hosts.deny to execute arbitrary commands as root.
Description
host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access restrictions in hosts.deny and gain root privileges by creating the temporary files before automatic IP blocking is performed.
Exploits (2)
This exploit leverages a race condition in ossec 2.8's insecure temporary file creation to escalate privileges. It monitors /tmp for file changes and injects a malicious entry into hosts.deny to execute arbitrary commands as root.
This repository contains a privilege escalation exploit for CVE-2014-5284, targeting OSSEC 2.8's insecure temporary file creation vulnerability. The exploit monitors /tmp for file changes and injects a command into a temporary hosts.deny file, which is then executed as root when SSH is accessed.