PT-2018-3442 · Suse · Supportutils+1

Vítězslav Čížek

·

Published

2018-11-29

·

Updated

2024-06-15

·

CVE-2018-19637

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions: Supportutils versions prior to 3.1-5.7.1
Description: The issue is related to incorrect handling of file access, allowing local attackers to overwrite files on systems without symlink protection. This can be exploited by an attacker to modify arbitrary files. The vulnerability is associated with the Supportutils package for the SUSE Linux operating system.
Recommendations: For versions prior to 3.1-5.7.1, update to version 3.1-5.7.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp/supp log file to minimize the risk of exploitation.

Exploit

Fix

Link Following

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-377CWE-59

Related Identifiers

BDU:2020-01560
CVE-2018-19637
OPENSUSE-SU-2019:0293-1
OPENSUSE-SU-2019_0293-1
OPENSUSE-SU-2019_1351-1
OPENSUSE-SU-2024:11415-1
SUSE-SU-2019:0480-1
SUSE-SU-2019:1122-1
SUSE-SU-2019_0480-1

Affected Products

Supportutils
Suse