CVE-2021-36795.md

August 3, 2021 FN51

File permission issues can lead to privilege escalation in Cohesity Linux Agent [CVE-2021-36795]

Problem Description

A permission issue in the Cohesity Linux agent may allow privilege escalation in version 6.5.1b to 6.5.1d-hotfix10, 6.6.0a to 6.6.0b-hotfix1. Vulnerability can allow an underprivileged linux user, if meets certain environment criteria, to gain additional privileges.

Impact

The vulnerability provides a user additional privileges if certain environment conditions are met.

CVSS Base Score : 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Resolution

To remediate the vulnerability, Cohesity recommends upgrading the linux agent to 6.5.1e or 6.6.0b with hotfix2. Customers using Linux agent through script installer can disregard this advisory.

Additional Information

Vulnerability does not impact if Linux agents were installed using Script Installer.

Software downloads are available here: http://downloads.cohesity.com If you have any questions, please reach out to Cohesity Support. email: support@cohesity.com

Vulnerability Type

Insecure Permissions

Vendor of Product

Cohesity, Inc

Affected Product Code Base

Cohesity Linux Agent - Affected versions are Cohesity Linux Agent versions 6.5.1b to 6.5.1d-hotfix10, 6.6.0a to 6.6.0b-hotfix1. Vulnerability does not impact if Linux agents were installed using Script Installer.

Affected Component

Cohesity Linux Backup Agent

Attack Type

Local

Impact Information Disclosure

True

Attack Vectors

To exploit the vulnerability attacker needs local access to the server

Has the vendor confirmed or acknowledged the vulnerability?

True

Discoverer

Cohesity acknowledges the efforts of Philippe Grégoire, who identified and disclosed the vulnerability, and Rocco Amico who participated in its responsible disclosure.