Vulnerability in chkrootkit - security update
Summary
DSA-2945-1: chkrootkit - security update. Affects chkrootkit versions < 0.49-4.1+deb7u2. Fixed in 0.49-4.1+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
chkrootkit is a rootkit detector that is used to scan systems for known rootkits and suspicious files. It is designed to detect various types of rootkits, including LKM (Loadable Kernel Module) rootkits, which are kernel modules that can be loaded and unloaded dynamically. chkrootkit is commonly used as a security tool to identify and remove rootkits from compromised systems.
Vulnerability Detail
A vulnerability has been discovered in chkrootkit that could allow local attackers to gain root access when the /tmp directory is mounted without the noexec option. This vulnerability arises from the fact that chkrootkit uses the /tmp directory to create temporary files during its scanning process. If an attacker has write access to the /tmp directory and can execute arbitrary code, they can exploit this vulnerability to gain root privileges on the system. This could lead to unauthorized access, data theft, or further compromise of the system.
How To Fix
Minimum fixed version
0.49-4.1+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade chkrootkitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the chkrootkit package is not immediately possible, a temporary workaround is to manually mount the /tmp directory with the noexec option. This can be done by modifying the /etc/fstab file and adding the 'noexec' option to the line that mounts the /tmp directory. After making the change, the system needs to be rebooted for the new mount options to take effect.
Conclusion
In conclusion, a vulnerability has been discovered in chkrootkit that could allow local attackers to gain root access on systems where the /tmp directory is mounted without the noexec option. It is recommended to upgrade the chkrootkit package to the latest version or apply the temporary workaround of manually mounting the /tmp directory with the noexec option. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for chkrootkit →
FAQ
chkrootkit is a rootkit detector used to scan systems for known rootkits and suspicious files.
This vulnerability allows local attackers to gain root access on systems where the /tmp directory is mounted without the noexec option. This can lead to unauthorized access, data theft, or further compromise of the system.
To fix this vulnerability, upgrade the chkrootkit package to version 0.49-4.1+deb7u2 or later. Ensure that the /tmp directory is mounted with the noexec option.
Yes, a temporary workaround is to manually mount the /tmp directory with the noexec option by modifying the /etc/fstab file.
Yes, you can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for chkrootkit.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
