Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2019-19455
CVE-2019-19455:
Wowza Streaming Engine vulnerability analysis and mitigation
Overview
Wowza Streaming Engine before version 4.8.5 has Insecure Permissions which may allow a local attacker to escalate privileges in /usr/local/WowzaStreamingEngine/manager/bin/. The vulnerability was discovered in versions prior to 4.8.5 and was fixed in version 4.8.5 released in June 2020 (Wowza Release Notes).
Technical details
The vulnerability exists because the installer sets relaxed permissions on core program files by default. A local user can write arbitrary commands in any file in /usr/local/WowzaStreamingEngine/manager/bin/ since they are writable by anyone and executed at boot or stop of the server as root (Wowza CVE).
Impact
The vulnerability allows a local attacker to write arbitrary commands in files that can be executed as root, effectively enabling privilege escalation to gain root access on the system (Wowza CVE).
Mitigation and workarounds
The vulnerability was fixed in Wowza Streaming Engine version 4.8.5. Users should upgrade to version 4.8.5 or later to mitigate this security issue (Wowza Release Notes).
Additional resources
Source: This report was generated using AI
Related Wowza Streaming Engine vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management