Exploits Discovered - Published CVE-2017-18284

Title: Gentoo app-backup/burp root privilege escalation via PID directory ownership

Author: Michael Orlitzky

Fixed in: Commits f9cf5c23, 88b7eff0, and 5cd39164

The Gentoo app-backup/burp package made its PID-file directory writable by the daemon runtime user. A local attacker controlling that PID file could cause a root-run service stop operation to signal an attacker-selected process, including a root process.

Michael Orlitzky’s detailed advisory provides the full technical disclosure and remediation references for CVE-2017-18284.

Common Vulnerabilities and Exposures (CVE) provides standard public identifiers for known cybersecurity vulnerabilities. MITRE maintains the CVE program and coordinates its vulnerability-identification ecosystem in the public interest.

Founded in 1994, Metro Data, Inc. is an information-systems and services firm that works exclusively with business clients to develop and apply technology solutions aligned with client goals.

Metro Data’s end-to-end experience helps customers keep pace with changing technology, secure systems, reduce costs, and improve information-system performance.

Michael J. Orlitzky is a long-time Metro Data technical leader with a Ph.D. in mathematics who has discovered and helped remediate vulnerabilities in operating systems and application software, with research recognized by industry and academic peers.