PT-2019-13193 · Deepin · Deepin-Clone

Hillwood Yang · Published 2019-07-04 · Updated 2019-07-28 · CVE-2019-13227

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions deepin-clone versions prior to 1.1.3

Description The issue allows an unprivileged user to potentially create or overwrite files in arbitrary file system locations by preparing a symlink attack at the fixed path /tmp/.deepin-clone.log. The content of the created or overwritten files is not controlled by the attacker.

Recommendations For versions prior to 1.1.3, update to version 1.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp/.deepin-clone.log file to prevent symlink attacks until the update is applied.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2019-13227

Affected Products

Deepin-Clone

References · 7

• https://github.com/linuxdeepin/deepin-clone/commit/e079f3e2712b4f8c28e3e63e71ba1a1f90fce1ab · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCHGRJV5CWTMYEE5B5C2FNMCFVP45S7H · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13227 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13227 · Security Note
• http://openwall.com/lists/oss-security/2019/07/04/1 · Note
• https://t.me/cvenotify/172 · Telegram Post
• https://bugzilla.suse.com/show_bug.cgi?id=1130388 · Note