Skip to content

v2.1.0p41-rc1

@rseltmann rseltmann tagged this 20 Mar 16:09
The informix database monitoring plugin would previously `eval` statements parsed from `$INFORMIXDIR/bin/onstat`. Since the plugin is usually run as root, this could cause statements injected in `$INFORMIXDIR/bin/onstat` to be run as root as well.
By adding scripts named the same as other functionality found in `$PATH` to `$INFORMIXDIR/bin`, `$PATH` functionality could also be overshadowed and the custom executed as root.
Finally, `$INFORMIXDIR/bin/onstat` would be executed as root, allowing a substituted script to be run with elevated privileges.

With this werk, the environment variables will be exported instead and `$PATH` will now be searched before `$INFORMIXDIR/bin`.
The plugin will now also check if `$INFORMIXDIR/bin/onstat` belongs to root if the plugin is executed as root. If not, it will be executed as the user owning the executable.

Change-Id: Idfe1d31c80998c6067baa718df9fb0a5c293eb27
Assets 2
Loading