CVE-2004-1445 in Nessus
Summary
by MITRE
A race condition in nessus-adduser in Nessus 2.0.11 and possibly earlier versions, if the TMPDIR environment variable is not set, allows local users to gain privileges.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/28/2019
The vulnerability described in CVE-2004-1445 represents a critical race condition flaw in the nessus-adduser utility that shipped with Nessus version 2.0.11 and potentially earlier releases. This issue specifically affects the privilege escalation mechanism within the Nessus network scanning tool, creating a security weakness that local attackers can exploit to elevate their privileges on the system. The vulnerability is particularly concerning because it leverages a fundamental flaw in how temporary files are handled during user creation processes, making it accessible to any user with local access to the system.
The technical implementation of this race condition occurs when the nessus-adduser utility operates without a properly configured TMPDIR environment variable. When this variable is unset, the utility defaults to using the /tmp directory for temporary file operations during user account creation. The race condition manifests when multiple processes attempt to create or modify temporary files in this shared directory simultaneously, creating opportunities for malicious file replacement or manipulation. Attackers can exploit this timing window to substitute legitimate temporary files with malicious ones, potentially leading to privilege escalation when the system executes these manipulated files with elevated privileges. This vulnerability directly maps to CWE-367, which identifies the weakness of time-of-check to time-of-use race conditions, and aligns with ATT&CK technique T1068 which covers privilege escalation through race conditions.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it can enable attackers to gain unauthorized access to sensitive system resources, modify system configurations, or establish persistent access points within the network scanning environment. Since Nessus is commonly used for security assessments and network monitoring, compromising the adduser utility creates a significant risk for organizations that rely on this tool for their security infrastructure. The vulnerability affects systems where Nessus is installed and where local users have access to execute the nessus-adduser command, making it particularly dangerous in multi-user environments or systems where users have legitimate administrative access but could be compromised. The exploitation requires local system access and understanding of the specific timing window, but once achieved, provides attackers with elevated privileges that can be used to further compromise the system or access other network resources.
Mitigation strategies for this vulnerability involve several key approaches that address both the immediate security flaw and broader system hardening practices. The primary recommendation is to ensure that the TMPDIR environment variable is properly configured and that temporary files are created in secure directories with appropriate permissions. System administrators should implement proper file permission controls and consider using more secure temporary file creation methods that prevent race conditions. Additionally, organizations should consider upgrading to newer versions of Nessus where this vulnerability has been addressed, as version 2.0.11 represents an older release that likely contains multiple other security issues. The remediation process should include reviewing system configurations to ensure that environment variables are properly set and that temporary file handling follows secure coding practices. Security monitoring should also be enhanced to detect unusual file creation patterns in temporary directories that might indicate exploitation attempts. This vulnerability highlights the importance of proper environment variable handling and secure temporary file management in system utilities, and serves as a reminder that even seemingly simple utilities can contain critical security flaws that can be exploited for privilege escalation.