needrestart up to 3.7 Environment Variable PYTHONPATH uncontrolled search path

Summaryinfo

A vulnerability, which was classified as problematic, has been found in needrestart up to 3.7. This affects an unknown function of the component Environment Variable Handler. The manipulation of the argument PYTHONPATH leads to Local Privilege Escalation. This vulnerability is listed as CVE-2024-48990. The attack must be carried out locally. In addition, an exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in needrestart up to 3.7 (Operating System Utility Software). This issue affects an unknown functionality of the component Environment Variable Handler. The manipulation of the argument PYTHONPATH with an unknown input leads to a local privilege escalation vulnerability. Using CWE to declare the problem leads to CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.

The identification of this vulnerability is CVE-2024-48990 since 10/11/2024. The exploitation is known to be easy. An attack has to be approached locally. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1574 for this issue.

The exploit is available at packetstormsecurity.com. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 211606 (Debian dla-3957 : needrestart - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.8 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (211606). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System Utility Software

Name

• needrestart

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion