PT-2019-6102 · Opensuse · Privoxy

Johannes Segitz · Published 2019-11-21 · Updated 2021-09-14 · CVE-2019-3699

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions privoxy versions 3.0.28-lp151.1.1 and prior versions privoxy versions 3.0.28-2.1 and prior versions

Description The issue is related to a UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1 and Factory. This vulnerability allows local attackers to escalate from user privoxy to root. The exploitation of this vulnerability may allow an attacker to gain elevated privileges.

Recommendations For privoxy version 3.0.28-lp151.1.1 and prior versions, update to a version that fixes the Symlink Following vulnerability. For privoxy version 3.0.28-2.1 and prior versions, update to a version that fixes the Symlink Following vulnerability. As a temporary workaround, consider restricting access to the vulnerable privoxy packaging to minimize the risk of exploitation.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2021-05384

CVE-2019-3699

Affected Products

Privoxy

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-3699 · Security Note
• https://bdu.fstec.ru/vul/2021-05384 · Security Note
• https://bugzilla.suse.com/show_bug.cgi?id=1157449 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3699 · Vendor Advisory
• https://t.me/cvenotify/20825 · Telegram Post
• https://build.opensuse.org/request/show/853516 · Note
• https://suse.com/security/cve/CVE-2019-3699.html · Note