CVE-2021-33393
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2021-33393
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-33393.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2021-33393
- Published
- 2021-06-09T22:15:08Z
- Modified
- 2025-01-08T10:45:58.555565Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. It might be owned by an unprivileged account, which could potentially be used to install a Trojan horse backup.pl script that is later executed by root. Similar problems with the ownership/permissions of other files may be present as well.
- References
-
- http://packetstormsecurity.com/files/163158/IPFire-2.25-Remote-Code-Execution.html
- https://github.com/MucahitSaratar/ipfire-2-25-auth-rce
- https://github.com/ipfire/ipfire-2.x/commit/6769d909306d7bdc43d64598872126fcf1b217f6
- https://github.com/ipfire/ipfire-2.x/commits/master?since=2021-05-17&until=2021-05-17
Affected packages
Git / github.com/ipfire/ipfire-2.x
Affected ranges
- Type
- GIT
- Repo
- https://github.com/ipfire/ipfire-2.x
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
Affected versions
v2.*
v2.11-core56
v2.11-core57
v2.11-core58
v2.11-core59
v2.11-core60
v2.11-core61
v2.11-core62
v2.11-core63
v2.11-core64
v2.13-beta1
v2.13-beta2
v2.13-core66
v2.13-core67
v2.13-core68
v2.13-core69
v2.13-core70
v2.13-core71
v2.13-core72
v2.13-core73
v2.13-core74
v2.13-core75
v2.13-rc1
v2.13-rc2
v2.15-beta1
v2.15-beta2
v2.15-core77
v2.15-core79
v2.15-core80
v2.15-core81
v2.15-core82
v2.15-core84
v2.15-core85
v2.15-rc1
v2.15-rc2
v2.17-core87
v2.17-core91
v2.17-core92
v2.17-core93
v2.17-core94
v2.17-core95
v2.17-core97
v2.17-core98
v2.17-core99
v2.19-core100
v2.19-core101
v2.19-core102
v2.19-core103
v2.19-core104
v2.19-core105
v2.19-core108
v2.19-core109
v2.19-core110
v2.19-core111
v2.19-core112
v2.19-core114
v2.19-core115
v2.19-core116
v2.19-core117
v2.19-core118
v2.19-core120
v2.21-core123
v2.21-core124
v2.21-core125
v2.21-core128
v2.23-core131
v2.23-core133
v2.23-core135
v2.23-core136
v2.23-core137
v2.23-core138
v2.23-core139
v2.25-core141
v2.25-core142
v2.25-core143
v2.25-core144
v2.25-core145
v2.25-core146
v2.25-core147
v2.25-core148
v2.25-core149
v2.25-core150
v2.25-core151
v2.25-core152
v2.3-beta1
v2.3-beta2
v2.3-beta3
v2.3-beta4
v2.3-beta5
v2.3-final
v2.3-rc1
v2.5-beta1
v2.5-beta2
v2.5-beta3
v2.5-core29
v2.5-core30
v2.5-core31
v2.5-final
v2.5-rc1
v2.9-beta1
v2.9-beta2
v2.9-core45
v2.9-core46
v2.9-core47
v2.9-core48
v2.9-core49
v2.9-core50
v2.9-core51
v2.9-core52
v2.9-core53
v2.9-core54
v2.9-core55
v2.9-final
v2.9-rc1