August 3, 2021 FN51
File permission issues can lead to privilege escalation in Cohesity Linux Agent [CVE-2021-36795]
Problem Description
A permission issue in the Cohesity Linux agent may allow privilege escalation in version 6.5.1b to 6.5.1d-hotfix10, 6.6.0a to 6.6.0b-hotfix1. Vulnerability can allow an underprivileged linux user, if meets certain environment criteria, to gain additional privileges.
Impact
The vulnerability provides a user additional privileges if certain environment conditions are met.
CVSS Base Score : 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Resolution
To remediate the vulnerability, Cohesity recommends upgrading the linux agent to 6.5.1e or 6.6.0b with hotfix2. Customers using Linux agent through script installer can disregard this advisory.
Additional Information
Vulnerability does not impact if Linux agents were installed using Script Installer.
Software downloads are available here: http://downloads.cohesity.com If you have any questions, please reach out to Cohesity Support. email: support@cohesity.com
Vulnerability Type
Insecure Permissions
Vendor of Product
Cohesity, Inc
Affected Product Code Base
Cohesity Linux Agent - Affected versions are Cohesity Linux Agent versions 6.5.1b to 6.5.1d-hotfix10, 6.6.0a to 6.6.0b-hotfix1. Vulnerability does not impact if Linux agents were installed using Script Installer.
Affected Component
Cohesity Linux Backup Agent
Attack Type
Local
Impact Information Disclosure
True
Attack Vectors
To exploit the vulnerability attacker needs local access to the server
Has the vendor confirmed or acknowledged the vulnerability?
True
Discoverer
Cohesity acknowledges the efforts of Philippe Grégoire, who identified and disclosed the vulnerability, and Rocco Amico who participated in its responsible disclosure.