PT-2019-13193 · Deepin · Deepin-Clone

Hillwood Yang · Publicado 2019-07-04 · Atualizado 2019-07-28 · CVE-2019-13227

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Média

Vetor base

AV:L/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions deepin-clone versions prior to 1.1.3

Description The issue allows an unprivileged user to potentially create or overwrite files in arbitrary file system locations by preparing a symlink attack at the fixed path /tmp/.deepin-clone.log. The content of the created or overwritten files is not controlled by the attacker.

Recommendations For versions prior to 1.1.3, update to version 1.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp/.deepin-clone.log file to prevent symlink attacks until the update is applied.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2019-13227

Produtos afetados

Deepin-Clone

Referências · 7

• https://github.com/linuxdeepin/deepin-clone/commit/e079f3e2712b4f8c28e3e63e71ba1a1f90fce1ab · Correção
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCHGRJV5CWTMYEE5B5C2FNMCFVP45S7H · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-13227 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13227 · Nota de Segurança
• http://openwall.com/lists/oss-security/2019/07/04/1 · Nota
• https://t.me/cvenotify/172 · Publicação no Telegram
• https://bugzilla.suse.com/show_bug.cgi?id=1130388 · Nota