Monkey HTTP Daemon Local Privilege Escalation Vulnerability

Bugtraq ID:	55639
Class:	Design Error
CVE:	CVE-2012-4443
Remote:	No
Local:	Yes
Published:	Sep 21 2012 12:00AM
Updated:	Sep 21 2012 12:00AM
Credit:	John Lightsey
Vulnerable:
Not Vulnerable:

Monkey HTTP Daemon Local Privilege Escalation Vulnerability

Monkey HTTP Daemon is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to execute arbitrary code with root privileges and completely compromise the affected computer.

Monkey HTTP Daemon 0.9.3-1 is vulnerable; other versions may also be affected.

Monkey HTTP Daemon Local Privilege Escalation Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

Monkey HTTP Daemon Local Privilege Escalation Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Monkey HTTP Daemon Local Privilege Escalation Vulnerability

References:

• Monkey Homepage (Monkey)
  
• monkey: CGI scripts executed without dropping RUID/RGID root (John Lightsey)