CVE-2018-1088

Published: Apr 18, 2018Modified: Nov 21, 2024

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.

Affected (7)

Products: Redhat: Enterprise Linux Server, Gluster Storage, Virtualization, Virtualization Host · Opensuse: Leap · Debian: Debian Linux

4 products

Enterprise Linux Server

Gluster Storage

Virtualization Host

1 product

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Gluster Storage	From 3.0 to 3.13.2
Redhat Virtualization	Version 4.0
Redhat Virtualization Host	Version 4.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Related CWEs

Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

References (16)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2018:1136

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:1137

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:1275

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:1524

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1558721

Source: secalert@redhat.com

Issue TrackingPatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/201904-06

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2018:1136

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:1137

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:1275

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:1524

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1558721

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/201904-06

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.