Vulnerability Description
A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The installer sets too relaxed permissions on /usr/local/WowzaStreamingEngine/bin/* core program files. By injecting a payload into one of those files, it will run with the same privileges as the Wowza server, root. For example, /usr/local/WowzaStreamingEngine/bin/tune.sh could be replaced with a Trojan horse. This issue was resolved in Wowza Streaming Engine 4.8.5.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wowza | Streaming Engine | <= 4.8.0 |
Related Weaknesses (CWE)
References
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7656-PrivEscalExploitThird Party Advisory
- https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streamThird Party Advisory
- https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notesRelease NotesVendor Advisory
- https://www.wowza.com/pricing/installerVendor Advisory
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7656-PrivEscalExploitThird Party Advisory
- https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streamThird Party Advisory
- https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notesRelease NotesVendor Advisory
- https://www.wowza.com/pricing/installerVendor Advisory
FAQ
What is CVE-2019-7656?
CVE-2019-7656 is a vulnerability with a CVSS score of 7.8 (HIGH). A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The installer sets too relaxed permissions on /usr/l...
How severe is CVE-2019-7656?
CVE-2019-7656 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-7656?
Check the references section above for vendor advisories and patch information. Affected products include: Wowza Streaming Engine.