Privilege Escalation Vulnerability in Wowza Streaming Engine by Wowza

CVE-2019-7656

What is CVE-2019-7656?

A privilege escalation vulnerability exists in Wowza Streaming Engine versions 4.8.0 and earlier, which allows unprivileged users on Linux systems to gain root access. The problem arises from overly permissive settings on critical core program files in the installer, specifically in the directory /usr/local/WowzaStreamingEngine/bin/. This flaw permits an attacker to replace scripts like tune.sh with malicious payloads that execute with root privileges when the Wowza server is operational. The vulnerability has been addressed in version 4.8.5 of the software, highlighting the importance of keeping systems updated.

References