CVE-2014-0476

What it actually does

The slapper function in chkrootkit fails to quote file paths before passing them to a shell, enabling a local attacker to substitute a Trojan executable in /tmp that gets executed with the privileges of the chkrootkit process.

Why it matters to the business

A user with local access can gain code execution on systems running vulnerable chkrootkit versions, undermining the tool's purpose as a rootkit detector and potentially leading to full system compromise; the issue is mitigated only when /tmp is mounted noexec.

How an attack unfolds

An attacker creates a malicious executable in /tmp with a name that chkrootkit's slapper function will reference without quotes, then invokes chkrootkit (often via cron or manual scan) so the shell executes the attacker's binary instead of the intended path.

How to fix it

Upgrade chkrootkit to version 0.50 or later on all affected systems; additionally ensure /tmp is mounted with the noexec option where feasible and audit any automated chkrootkit invocations.

How to confirm the fix worked

Confirm chkrootkit version is 0.50 or newer via package manager or binary output; test that running the tool no longer executes arbitrary files placed in /tmp; verify /tmp mount options include noexec.

Typical attack path

1. Place a crafted executable in /tmp with a predictable name referenced by chkrootkit
2. Trigger chkrootkit execution (manual, scripted, or scheduled)
3. Unquoted path causes shell to run the attacker-controlled binary
4. Attacker code executes with chkrootkit privileges

How to detect it

Review system logs and process execution history for chkrootkit invocations that coincide with unexpected child processes or files created in /tmp; examine cron and user shell histories for chkrootkit runs; look for binaries in /tmp whose names align with known chkrootkit checks.

• /tmp/update
• chkrootkit process spawning unexpected children from /tmp
• executable files in /tmp created shortly before chkrootkit execution

What your security team should do

• Immediately replace chkrootkit with a maintained alternative or upgrade to 0.50+
• Add noexec to /tmp mount options in /etc/fstab and remount
• Remove or disable any scheduled chkrootkit jobs until fixed
• Scan systems for unexpected executables in /tmp that match historical chkrootkit check names