CVE-2011-2921

EPSS 82.8%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 82.8%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

13 Aug 2011Metasploit module available

03 Sep 2019Public PoC

19 Nov 2019Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can result in command execution with root privileges.

Affected products

ktsuss · ktsuss

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/154307/ktsuss-Suid-Privilege-Escalation.htmlunverified exploitdbwww.exploit-db.com/exploits/47344unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/154307/ktsuss-Suid-Privilege-Escalation.html https://access.redhat.com/security/cve/cve-2011-2921 https://security-tracker.debian.org/tracker/CVE-2011-2921