← Back

CVE-2019-3688

nvd nist
Published: Oct 7, 2019Modified: Nov 21, 2024

JSON object

Loading...
7.1
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Exploitability: 1.8 / Impact: 5.2
Source: NVD

Description

The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain persistence by changing the binary

Affected (5)

Suse
1 product
Suse Linux Enterprise Server
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Suse
Suse Linux Enterprise Server
Version 12 sp1
Suse Linux Enterprise Server
Version 12 sp2
Suse Linux Enterprise Server
Version 12 sp3
Suse Linux Enterprise Server
Version 15
Suse Linux Enterprise Server
Version 15 sp1

Related CWEs

CWE-276
Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.

References (8)

Source: meissner@suse.de
Source: meissner@suse.de
Source: meissner@suse.de
Source: meissner@suse.de
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory

Timeline

No history available yet.