CVE-2014-5284: host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying owne

Q: How do I fix CVE-2014-5284?

ossec: upgrade to newer than 2.8.0. Exact commands for each OS are on this page.

Q: Is CVE-2014-5284 being exploited?

CVE-2014-5284 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2014-5284 affect?

CVE-2014-5284 affects ossec. Severity is high (CVSS 7.2). host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access restrictions in hosts.deny and gain root privileges by creating the temporary fil

Q: How urgent is CVE-2014-5284?

Priority 51/100. High severity; Public exploit reference

This month

HIGH 7.2UPGRADE

CVE-2014-5284 is a high-severity flaw (CVSS 7.2) affecting ossec. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access restrictions in hosts.deny and gain root privileges by creating the temporary files before automatic IP blocking is performed.

Why this priority

High severity
Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	7.2 (High)
EPSS exploit chance	2.4% (top 16%)
CISA exploited list	No
Weakness	CWE-264
Published	2014-12-02
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: ossec

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2014-12-02 01:59 UTCPublished CVE record published
2026-06-17 00:11 UTCUpdated Record last modified

ossec ossec UPGRADE

Affected: <= 2.8.0

Fixed in: newer than 2.8.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy ossec || rpm -q ossec || ossec --version

2. UPGRADE to newer than 2.8.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade ossec

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade ossec

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Exploit-DB: OSSEC 2.8 - 'hosts.deny' Local Privilege Escalation

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2014-5284?

ossec: upgrade to newer than 2.8.0. Exact commands for each OS are on this page.

Is CVE-2014-5284 being exploited?

CVE-2014-5284 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2014-5284 affect?

CVE-2014-5284 affects ossec. Severity is high (CVSS 7.2). host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, which allows local users to modify access restrictions in hosts.deny and gain root privileges by creating the temporary fil

How urgent is CVE-2014-5284?

Priority 51/100. High severity; Public exploit reference

Related CVEs

CVE-2021-28040 HIGH 7.5 DOWNGRADE An issue was discovered in OSSEC 3.6.0
CVE-2020-8448 MEDIUM 5.5 UPGRADE In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulner
CVE-2020-8447 CRITICAL 9.8 UPGRADE In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulner
CVE-2020-8446 MEDIUM 5.5 UPGRADE In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulner
CVE-2020-8445 CRITICAL 9.8 UPGRADE In OSSEC-HIDS 2.7 through 3.5.0, the OS_CleanMSG function in ossec-analysisd doesn't remove or encode terminal

References

← Back to latest CVEs