PT-2017-7975 · Suse · Suse Linux Enterprise Server+3

Publicado 2016-06-07 · Atualizado 2018-10-30 · CVE-2016-1602

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise Server versions 12 and 12-SP1 SUSE Linux Enterprise Desktop versions 12 and 12-SP1

Description A code injection issue in the supportconfig data collection tool in supportutils could allow local attackers to execute code as the user running supportconfig, which is usually the root user.

Recommendations For SUSE Linux Enterprise Server versions 12 and 12-SP1, update the supportutils package to a version that includes the fix for this issue. For SUSE Linux Enterprise Desktop versions 12 and 12-SP1, update the supportutils package to a version that includes the fix for this issue.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2016-1602

SUSE-SU-2016:1507-1

SUSE-SU-2016:1514-1

SUSE-SU-2016_1507-1

SUSE-SU-2016_1514-1

Produtos afetados

Suse Linux Enterprise Desktop

Suse Linux Enterprise Server

Suse

Supportutils

Referências · 9

• https://suse.com/support/update/announcement/2016/suse-su-20161507-1 · Nota
• http://lists.suse.com/pipermail/sle-security-updates/2016-June/002096.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-1602 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2016:1514-1 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2016/suse-su-20161514-1 · Nota
• https://suse.com/security/cve/CVE-2016-1602 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2016:1507-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-1602 · Aviso do Fabricante
• https://bugzilla.suse.com/980670 · Nota