PT-2025-2937 · Teradata+1 · Teradata+1

Published 2025-01-08 · Updated 2025-01-08 · CVE-2024-52869

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Teradata versions prior to 2024-11-04

Description The issue concerns the mismanagement of groups by certain Teradata account-handling code when used with SUSE Enterprise Linux Server. Specifically, during an operating system change from SUSE Enterprise Linux Server (SLES) 12 Service Pack (SP) 2 or 3 to SLES 15 SP2 on Teradata Database systems, some service or system user accounts, and possibly user accounts created by the systems administrator, are incorrectly assigned to groups that allow higher system-level privileges than intended. This may lead to full system compromise, depending on the usage of these accounts.

Recommendations As a temporary workaround, consider restricting access to the affected groups until a patch is available. Restrict access to the SUSE Enterprise Linux Server to minimize the risk of exploitation. Avoid using the affected Teradata account-handling code until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2024-52869

Affected Products

Suse Linux Enterprise Server

Teradata

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-52869 · Security Note
• https://chrismanson.com/CVE/cve-2024-52869.html · Note
• https://twitter.com/CVEnew/status/1877101375651213383 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1877131120287891598 · Twitter Post
• https://teradata.com/trust-security-center/data-security · Note
• https://t.me/cvedetector/14739 · Telegram Post