OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored in an unprivileged user directory but the daemon is executed by root, it’s possible for the unprivileged user to change the config file and escalate permissions when root later runs the daemon. Version 0.9.4 contains a fix for the issue.
Metrics
Affected Vendors & Products
References
History
Thu, 17 Oct 2024 21:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Thinkst
Thinkst opencanary |
|
CPEs | cpe:2.3:a:thinkst:opencanary:*:*:*:*:*:*:*:* | |
Vendors & Products |
Thinkst
Thinkst opencanary |
|
Metrics |
cvssV3_1
|
Tue, 15 Oct 2024 15:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Mon, 14 Oct 2024 21:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored in an unprivileged user directory but the daemon is executed by root, it’s possible for the unprivileged user to change the config file and escalate permissions when root later runs the daemon. Version 0.9.4 contains a fix for the issue. | |
Title | OpenCanary Executes Commands From Potentially Writable Config File | |
Weaknesses | CWE-863 | |
References |
| |
Metrics |
cvssV4_0
|

Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-10-15T14:44:42.093Z
Reserved: 2024-10-09T22:06:46.171Z
Link: CVE-2024-48911

Updated: 2024-10-15T14:44:38.840Z

Status : Analyzed
Published: 2024-10-14T21:15:12.323
Modified: 2024-10-17T21:13:37.147
Link: CVE-2024-48911

No data.