PT-2019-6102 · Opensuse · Privoxy

Johannes Segitz · Publicado 2019-11-21 · Atualizado 2021-09-14 · CVE-2019-3699

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions privoxy versions 3.0.28-lp151.1.1 and prior versions privoxy versions 3.0.28-2.1 and prior versions

Description The issue is related to a UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1 and Factory. This vulnerability allows local attackers to escalate from user privoxy to root. The exploitation of this vulnerability may allow an attacker to gain elevated privileges.

Recommendations For privoxy version 3.0.28-lp151.1.1 and prior versions, update to a version that fixes the Symlink Following vulnerability. For privoxy version 3.0.28-2.1 and prior versions, update to a version that fixes the Symlink Following vulnerability. As a temporary workaround, consider restricting access to the vulnerable privoxy packaging to minimize the risk of exploitation.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

BDU:2021-05384

CVE-2019-3699

Produtos afetados

Privoxy

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-3699 · Nota de Segurança
• https://t.me/cvenotify/20825 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2021-05384 · Nota de Segurança
• https://bugzilla.suse.com/show_bug.cgi?id=1157449 · Aviso do Fabricante
• https://build.opensuse.org/request/show/853516 · Nota
• https://osv.dev/vulnerability/CVE-2019-3699 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-3699.html · Nota