Checkmk werks security June 2022

checkmk-werks-sec@lists.checkmk.com

2 participants
2 discussions

Checkmk Werk 14376: Mask passwords in rule export

by Hannes Rantzsch

ID: 14376 Title: Mask passwords in rule export Component: Setup Level: 1 Class: Security fix Version: 2.2.0i1 Mask sensitive information in the GUI view which displays the Rule representation for the REST API.

1 year, 11 months

Checkmk Werk 14098: Fix ownership of debian maintainer scripts for shipped agent package

by Moritz Kiemer

ID: 14098 Title: Fix ownership of debian maintainer scripts for shipped agent package Component: agents Level: 1 Class: Security fix Version: 2.2.0i1 This issue affects users that deployed the shipped version of the Checkmk agent Debian package. Packages created by the agent bakery (enterprise editions only) were not affected. Previous to this Werk a user with the UID 1001 on a monitored host could gain root privileges. This was caused by wrong file ownership of the maintainer scripts located at <tt>/var/lib/dpkg/info</tt>: they were owned by the user and group with the ID 1001 instead of root. If such a user exists on your system, they can change the content of these files which are later executed by root (during package installation, update or removal), leading to a local privilege escalation on the monitored host. To see if you are affected check the ownership of the files <tt>/var/lib/dpkg/info/check-mk-agent.*</tt> -- they should be owned by root and only writable by root. If those files are not owned by root, you should perform the following steps <b>before updating the agent</b>: LI: Ensure they have not been tampered with. LI: Either immediately upgrade the agent or change the ownership of the files to <tt>root.root</tt> and the permissions to <tt>755</tt> To make sure the files have not been tampered with, you can check out the expected content in the "%pre", "%post" and "%preun" sections of <a href="https://github.com/tribe29/checkmk/blob/master/agents/check-mk-agent.spec">this file</a> (make sure to select the right Checkmk version in the dropdown choice that reads "master"). To get an idea of what the files should look like in the 2.1.0 version, you can also look at the checked in versions of the master branch <a href="https://github.com/tribe29/checkmk/tree/master/agents/debian/control">here</a>. Note that smaller deviations are no cause for concern.

1 year, 11 months

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

Checkmk werks security June 2022