PT-2019-6218 · Opensuse+1 · Opensuse Leap+2

Malte Kraus

·

Publicado

2019-12-05

·

Atualizado

2024-06-15

·

CVE-2019-3690

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions permissions package versions prior to commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 openSUSE Leap (affected versions not specified)
Description The issue is related to the chkstat tool in the permissions package, which followed symlinks, allowing local attackers with control over a traversed path to escalate privileges. This is due to errors in handling symbolic links.
Recommendations For versions prior to commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230, consider applying the fix committed in a9e1d26cd49ef9ee0c2060c859321128a6dd4230 and review additional hardenings. For openSUSE Leap, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

BDU:2022-03981
CVE-2019-3690
OPENSUSE-SU-2019:2672-1
OPENSUSE-SU-2019_2672-1
OPENSUSE-SU-2024:11165-1
SUSE-SU-2019:14237-1
SUSE-SU-2019:3180-1
SUSE-SU-2019:3182-1
SUSE-SU-2019:3183-1
SUSE-SU-2019_14237-1
SUSE-SU-2020:1163-1
SUSE-SU-2021:2280-1

Produtos afetados

Suse
Opensuse Leap
Permissions