HTTP: Needrestart Local Arbitrary Code Execution
This signature detects attempts to exploit a known vulnerability against Needrestart. A successful attack can lead to elevation of privilege and arbitrary code execution.
Extended Description
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
References
CVE: CVE-2024-48990
Short Name
HTTP:STC:NEED-RESTART-LRCE
Severity
Major
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
Arbitrary CVE-2024-48990 Code Execution Local Needrestart
Release Date
04/03/2025
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3796
False Positive
Unknown