Vulnerability CVE-2019-3688


Published: 2019-10-07   Modified: 2019-10-08

Description:
The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain persistence by changing the binary

Type:

CWE-276

(Incorrect Default Permissions)

CVSS2 => (AV:L/AC:L/Au:N/C:N/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.6/10
9.2/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Complete
Complete
Affected software
SUSE -> Suse linux enterprise server 

 References:
https://bugzilla.suse.com/show_bug.cgi?id=1093414

Copyright 2020, cxsecurity.com

 

Back to Top