[checkmk-commits] [Checkmk/checkmk] 28968b: 16172 SEC kaspersky_av: Don't run kav4fs-control o...

Branch: refs/heads/master Home: https://github.com/Checkmk/checkmk Commit: 28968b0c34533199c8f03e4b0b1bd495221196d9 https://github.com/Checkmk/checkmk/commit/28968b0c34533199c8f03e4b0b1bd4952… Author: Sofia Colakovic <sofia.colakovic(a)checkmk.com> Date: 2024-02-27 (Tue, 27 Feb 2024) Changed paths: A .werks/16172.md M agents/plugins/kaspersky_av A tests/unit-shell/agents/plugins/test_kaspersky_av.sh Log Message: ----------- 16172 SEC kaspersky_av: Don't run kav4fs-control or kesl-control if they aren't owned by root Kaspersky Anti-Virus plugin uses /opt/kaspersky/kav4fs/bin/kav4fs-control and /opt/kaspersky/kesl/bin/kesl-control commands to monitor a Kaspersky Anti-Virus installation. To prevent privilege escalation, the plugin (which is run by root user) must not run executables which can be changed by less privileged users. In the default installation, kav4fs-control and kesl-control commands are owned by root and root is the only user with write permissions, which prevents privilege escalation attacks. With this Werk, the plugin checks if control commands are owned by root and root is the only user with write permissions before running the command. If that's not the case the commands won't be run. This prevents privilege escalation attacks if the permissions of the control commands have been changed. CMK-15318 Change-Id: Ie5de60541dbd76a983c9918ccf48a73ed1ee26f7 To unsubscribe from these emails, change your notification settings at https://github.com/Checkmk/checkmk/settings/notifications