PT-2019-12939 · Opensuse+4 · Libqb+4

Topimiettinen · Publicado 2019-04-03 · Atualizado 2021-07-03 · CVE-2019-12779

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions libqb versions prior to 1.0.5

Description The issue allows local users to overwrite arbitrary files via a symlink attack. This is because libqb uses predictable filenames under /dev/shm and /tmp without O EXCL.

Recommendations For versions prior to 1.0.5, update to version 1.0.5 or later to resolve the issue. As a temporary workaround, consider restricting access to /dev/shm and /tmp to minimize the risk of exploitation.

Exploit

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

ALT-PU-2019-1914

CESA-2019_3610

CESA-2020_1189

CVE-2019-12779

MGASA-2020-0048

OESA-2021-1141

OPENSUSE-SU-2019:1718-1

OPENSUSE-SU-2019:1752-1

OPENSUSE-SU-2019:1891-1

OPENSUSE-SU-2019_1718-1

OPENSUSE-SU-2019_1752-1

OPENSUSE-SU-2024:10974-1

RHSA-2019:3610

RHSA-2019_3610

RHSA-2020:1189

RHSA-2020_1189

SUSE-SU-2019:1791-1

SUSE-SU-2019:1806-1

SUSE-SU-2019:1812-1

SUSE-SU-2019_1791-1

SUSE-SU-2019_1806-1

SUSE-SU-2019_1812-1

Produtos afetados

Alt Linux

Centos

Red Hat

Suse

Libqb

Referências · 43

• 🔥 https://github.com/ClusterLabs/libqb/issues/338 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1695948 · Exploit
• https://github.com/ClusterLabs/libqb/releases/tag/v1.0.5 · Nota
• https://github.com/ClusterLabs/libqb/releases/tag/v1.0.4 · Nota
• https://osv.dev/vulnerability/CVE-2019-12779 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-12779 · Nota de Segurança
• https://lists.opensuse.org/opensuse-updates/2019-07/msg00083.html · Nota
• https://access.redhat.com/errata/RHSA-2019:3610 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-12779 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2020-0048 · Aviso do Fabricante
• https://security.gentoo.org/glsa/202107-03 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2019:1812-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2021-1141 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12779 · Nota de Segurança
• https://bugzilla.suse.com/1074327 · Nota