CVE-2019-19041

An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41

published November 17, 2019

CVSS
—
EPSS
2%
Percentile
80.7
In the wild
Unconfirmed
What it is

An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade package before processing it. As a result, official upgrade packages can be modified to inject an arbitrary Bash script that will be executed by the underlying system. It is possible to achieve this by modifying the values in the files.SUM file (which are used for integrity control) and injecting malicious code into the upgrade.sh file.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02013 · 80.7th percentile
Published
2019-11-17T20:52Z
EPSS history
Timeline
  • 17 NOV 20:52Z
    An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41
    cvelistv5