The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.

The remote host is affected by the vulnerability described in GLSA-201709-05 (chkrootkit: Local privilege escalation)

    When /tmp is mounted without the noexec option chkrootkit will execute       files in /tmp with root privileges.
  Impact :

    A local attacker could possibly execute arbitrary code with root       privileges.
  Workaround :

    Users should mount /tmp with noexec option.

A quoting issue was found in chkrootkit which would lead to a file in /tmp/ being executed, if /tmp/ was mounted without the noexec option.
chkrootkit is typically run as the root user. A local attacker could use this flaw to escalate their privileges.

A quoting issue was found in chkrootkit which would lead to a file in /tmp/ being executed, if /tmp/ was mounted without the noexec option.
chkrootkit is typically run as the root user. A local attacker could use this flaw to escalate their privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated chkrootkit package fixes security vulnerability :

The chkrootkit script contains a flaw that allows a local attacker to create an executable in /tmp that will be run by the user running chkrootkit (usually root), allowing the attacker to escalate privileges (CVE-2014-0476).

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2230-1 advisory.

    Thomas Stangner discovered that chkrootkit incorrectly quoted certain values. A local attacker could use     this issue to execute arbitrary code when chkrootkit is run and gain root privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Thomas Stangner discovered a vulnerability in chkrootkit, a rootkit detector, which may allow local attackers to gain root access when /tmp is mounted without the noexec option.

ID	Name	Product	Family	Severity
103273	GLSA-201709-05 : chkrootkit: Local privilege escalation	Nessus	Gentoo Local Security Checks	low
78313	Amazon Linux AMI : chkrootkit (ALAS-2014-370)	Nessus	Amazon Linux Local Security Checks	low
74502	Fedora 19 : chkrootkit-0.49-9.fc19 (2014-7090)	Nessus	Fedora Local Security Checks	low
74500	Fedora 20 : chkrootkit-0.49-9.fc20 (2014-7071)	Nessus	Fedora Local Security Checks	low
74480	Mandriva Linux Security Advisory : chkrootkit (MDVSA-2014:122)	Nessus	Mandriva Local Security Checks	low
74322	Ubuntu 14.04 LTS : chkrootkit vulnerability (USN-2230-1)	Nessus	Ubuntu Local Security Checks	high
74294	Debian DSA-2945-1 : chkrootkit - security update	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2014-0476

high

Tenable Plugins

low

low

low

low

low

high

low