PT-2019-9974 · Cerner · Cerner Connectivity Engine

Bryan Rhodes + 1 · Publicado 2019-04-25 · Atualizado 2019-10-03 · CVE-2018-20052

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cerner Connectivity Engine (CCE) version 4

Description An issue was discovered where the user running the main CCE firmware has NOPASSWD sudo privileges to several utilities, which could be used to escalate privileges to root. For example, the command "sudo ln -s /tmp/script /etc/cron.hourly/script" could be utilized.

Recommendations For Cerner Connectivity Engine (CCE) version 4, restrict the sudo privileges of the user running the main CCE firmware to prevent escalation to root. As a temporary workaround, consider disabling the use of sudo for the affected utilities until a more permanent solution is implemented.

Correção

Enumeração de Fraquezas

CWE-1188

Identificadores relacionados

CVE-2018-20052

Produtos afetados

Cerner Connectivity Engine

Referências · 3

• https://securifera.com/advisories/cve-2018-20052-20053 · Nota
• https://osv.dev/vulnerability/CVE-2018-20052 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-20052 · Nota de Segurança