CVE-2017-5198 : Security Advisory and Response

SolarWinds LEM (SIEM) before version 6.3.1 has a vulnerability in its sudo configuration that allows local users to gain root access by modifying a specific file.

Understanding CVE-2017-5198

SolarWinds LEM (SIEM) vulnerability pre-6.3.1 enables unauthorized root access through a flawed sudo configuration.

What is CVE-2017-5198?

The CVE-2017-5198 vulnerability in SolarWinds LEM (SIEM) allows local users to escalate privileges to root by altering a critical file.

The Impact of CVE-2017-5198

This vulnerability poses a significant security risk as it permits unauthorized users to gain full root access on affected systems.

Technical Details of CVE-2017-5198

SolarWinds LEM (SIEM) vulnerability details and affected systems.

Vulnerability Description

The flaw in SolarWinds LEM (SIEM) versions prior to 6.3.1 allows local users to exploit sudo misconfiguration to achieve root privileges by modifying a specific file.

Affected Systems and Versions

Product: SolarWinds LEM (SIEM)
Versions Affected: Prior to 6.3.1

Exploitation Mechanism

Attackers with local access can manipulate the /usr/local/contego/scripts/hostname.sh file to gain root privileges.

Mitigation and Prevention

Steps to mitigate and prevent the CVE-2017-5198 vulnerability.

Immediate Steps to Take

Upgrade SolarWinds LEM (SIEM) to version 6.3.1 or above to patch the sudo misconfiguration.
Monitor system logs for any unauthorized access attempts.

Long-Term Security Practices

Implement the principle of least privilege to restrict user access rights.
Regularly review and update sudo configurations to prevent similar vulnerabilities.

Patching and Updates

Apply security patches and updates provided by SolarWinds promptly to address known vulnerabilities.