CVE-2021-33393

lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the ownership/permissions of other files may be present as well.

Link	Resource
https://github.com/ipfire/ipfire-2.x/commit/6769d909306d7bdc43d64598872126fcf1b217f6	Patch Third Party Advisory
https://github.com/ipfire/ipfire-2.x/commits/master?since=2021-05-17&until=2021-05-17	Third Party Advisory
https://github.com/MucahitSaratar/ipfire-2-25-auth-rce	Exploit Third Party Advisory
http://packetstormsecurity.com/files/163158/IPFire-2.25-Remote-Code-Execution.html	Exploit Third Party Advisory

Configuration 1

cpe:2.3:a:ipfire:ipfire:2.25:core_update142:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.25:core_update143:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.25:core_update144:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.25:core_update145:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.25:core_update146:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.25:core_update147:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.25:core_update148:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.25:core_update149:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.25:core_update150:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.25:core_update151:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.25:core_update152:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.25:core_update155:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.25:core_update156:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:2.25:core_update141:*:*:*:*:*:* cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*

---

Published : 2021-06-09 10:15

Updated : 2022-07-12 05:42

---

NVD link : CVE-2021-33393

Mitre link : CVE-2021-33393

No products.

NVD-CWE-Other