PT-2019-13195 · Deepin · Deepin-Clone

Hillwood Yang · Published 2019-07-04 · Updated 2019-08-14 · CVE-2019-13229

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions deepin-clone versions prior to 1.1.3

Description The issue allows an unprivileged user to create or overwrite files in arbitrary file system locations by preparing a symlink attack. This is due to the use of a fixed path /tmp/partclone.log in the Helper::getPartitionSizeInfo() function to write a log file as root, which follows symlinks. However, the content of the files is not controlled by the attacker.

Recommendations For deepin-clone versions prior to 1.1.3, update to version 1.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp/partclone.log file to prevent symlink attacks until a patch is available.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2019-13229

Affected Products

Deepin-Clone

References · 7

• https://github.com/linuxdeepin/deepin-clone/commit/e079f3e2712b4f8c28e3e63e71ba1a1f90fce1ab · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCHGRJV5CWTMYEE5B5C2FNMCFVP45S7H · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13229 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13229 · Security Note
• http://openwall.com/lists/oss-security/2019/07/04/1 · Note
• https://t.me/cvenotify/174 · Telegram Post
• https://bugzilla.suse.com/show_bug.cgi?id=1130388 · Note