Log in Start free

Vulnerability · Published Mar 2, 2020 · Assigned by suse

CVE-2020-8013permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim

Low 2.2

In plain English

A low-severity security flaw in SUSE Linux Enterprise Server 11 from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)2.2Low
Exploit odds (30 days)0.3%top 75.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.

Affected products (as reported)

VendorProductVersions
SUSE SUSE Linux Enterprise Server 12 permissions – before 2015.09.28.1626-17.27.1
SUSE SUSE Linux Enterprise Server 15 permissions – before 20181116-9.23.1
SUSE SUSE Linux Enterprise Server 11 permissions – before 2013.1.7-0.6.12.1

Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

References