csaf_opensuse - opensuse-su-2024:11165-1

opensuse-su-2024:11165-1

Vulnerability from csaf_opensuse

Published

2024-06-15 00:00

Modified

2024-06-15 00:00

Summary

chkstat-1550_20210901-29.2 on GA media

Notes

Title of the patch

chkstat-1550_20210901-29.2 on GA media

Description of the patch

These are all security issues fixed in the chkstat-1550_20210901-29.2 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2024-11165

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "chkstat-1550_20210901-29.2 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the chkstat-1550_20210901-29.2 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-11165",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11165-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-3687 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-3687/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-3688 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-3688/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-3690 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-3690/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8013 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8013/"
      }
    ],
    "title": "chkstat-1550_20210901-29.2 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:11165-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "chkstat-1550_20210901-29.2.aarch64",
                "product": {
                  "name": "chkstat-1550_20210901-29.2.aarch64",
                  "product_id": "chkstat-1550_20210901-29.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "permissions-1550_20210901.1550-29.2.aarch64",
                "product": {
                  "name": "permissions-1550_20210901.1550-29.2.aarch64",
                  "product_id": "permissions-1550_20210901.1550-29.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "permissions-config-1550_20210901-29.2.aarch64",
                "product": {
                  "name": "permissions-config-1550_20210901-29.2.aarch64",
                  "product_id": "permissions-config-1550_20210901-29.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
                "product": {
                  "name": "permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
                  "product_id": "permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "chkstat-1550_20210901-29.2.ppc64le",
                "product": {
                  "name": "chkstat-1550_20210901-29.2.ppc64le",
                  "product_id": "chkstat-1550_20210901-29.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "permissions-1550_20210901.1550-29.2.ppc64le",
                "product": {
                  "name": "permissions-1550_20210901.1550-29.2.ppc64le",
                  "product_id": "permissions-1550_20210901.1550-29.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "permissions-config-1550_20210901-29.2.ppc64le",
                "product": {
                  "name": "permissions-config-1550_20210901-29.2.ppc64le",
                  "product_id": "permissions-config-1550_20210901-29.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
                "product": {
                  "name": "permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
                  "product_id": "permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "chkstat-1550_20210901-29.2.s390x",
                "product": {
                  "name": "chkstat-1550_20210901-29.2.s390x",
                  "product_id": "chkstat-1550_20210901-29.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "permissions-1550_20210901.1550-29.2.s390x",
                "product": {
                  "name": "permissions-1550_20210901.1550-29.2.s390x",
                  "product_id": "permissions-1550_20210901.1550-29.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "permissions-config-1550_20210901-29.2.s390x",
                "product": {
                  "name": "permissions-config-1550_20210901-29.2.s390x",
                  "product_id": "permissions-config-1550_20210901-29.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
                "product": {
                  "name": "permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
                  "product_id": "permissions-zypp-plugin-1550_20210901.1550-29.2.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "chkstat-1550_20210901-29.2.x86_64",
                "product": {
                  "name": "chkstat-1550_20210901-29.2.x86_64",
                  "product_id": "chkstat-1550_20210901-29.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "permissions-1550_20210901.1550-29.2.x86_64",
                "product": {
                  "name": "permissions-1550_20210901.1550-29.2.x86_64",
                  "product_id": "permissions-1550_20210901.1550-29.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "permissions-config-1550_20210901-29.2.x86_64",
                "product": {
                  "name": "permissions-config-1550_20210901-29.2.x86_64",
                  "product_id": "permissions-config-1550_20210901-29.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64",
                "product": {
                  "name": "permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64",
                  "product_id": "permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chkstat-1550_20210901-29.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.aarch64"
        },
        "product_reference": "chkstat-1550_20210901-29.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chkstat-1550_20210901-29.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.ppc64le"
        },
        "product_reference": "chkstat-1550_20210901-29.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chkstat-1550_20210901-29.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.s390x"
        },
        "product_reference": "chkstat-1550_20210901-29.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "chkstat-1550_20210901-29.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.x86_64"
        },
        "product_reference": "chkstat-1550_20210901-29.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "permissions-1550_20210901.1550-29.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.aarch64"
        },
        "product_reference": "permissions-1550_20210901.1550-29.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "permissions-1550_20210901.1550-29.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.ppc64le"
        },
        "product_reference": "permissions-1550_20210901.1550-29.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "permissions-1550_20210901.1550-29.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.s390x"
        },
        "product_reference": "permissions-1550_20210901.1550-29.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "permissions-1550_20210901.1550-29.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.x86_64"
        },
        "product_reference": "permissions-1550_20210901.1550-29.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "permissions-config-1550_20210901-29.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.aarch64"
        },
        "product_reference": "permissions-config-1550_20210901-29.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "permissions-config-1550_20210901-29.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.ppc64le"
        },
        "product_reference": "permissions-config-1550_20210901-29.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "permissions-config-1550_20210901-29.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.s390x"
        },
        "product_reference": "permissions-config-1550_20210901-29.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "permissions-config-1550_20210901-29.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.x86_64"
        },
        "product_reference": "permissions-config-1550_20210901-29.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64"
        },
        "product_reference": "permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le"
        },
        "product_reference": "permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "permissions-zypp-plugin-1550_20210901.1550-29.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.s390x"
        },
        "product_reference": "permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64"
        },
        "product_reference": "permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-3687",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-3687"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the \"easy\" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to 081d081dcfaf61710bda34bc21c80c66276119aa.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.aarch64",
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.ppc64le",
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.s390x",
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.x86_64",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.aarch64",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.ppc64le",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.s390x",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.x86_64",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.aarch64",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.ppc64le",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.s390x",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.x86_64",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-3687",
          "url": "https://www.suse.com/security/cve/CVE-2019-3687"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1148788 for CVE-2019-3687",
          "url": "https://bugzilla.suse.com/1148788"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180102 for CVE-2019-3687",
          "url": "https://bugzilla.suse.com/1180102"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-3687"
    },
    {
      "cve": "CVE-2019-3688",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-3688"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain persistence by changing the binary",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.aarch64",
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.ppc64le",
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.s390x",
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.x86_64",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.aarch64",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.ppc64le",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.s390x",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.x86_64",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.aarch64",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.ppc64le",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.s390x",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.x86_64",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-3688",
          "url": "https://www.suse.com/security/cve/CVE-2019-3688"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1093414 for CVE-2019-3688",
          "url": "https://bugzilla.suse.com/1093414"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1149108 for CVE-2019-3688",
          "url": "https://bugzilla.suse.com/1149108"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-3688"
    },
    {
      "cve": "CVE-2019-3690",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-3690"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.aarch64",
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.ppc64le",
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.s390x",
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.x86_64",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.aarch64",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.ppc64le",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.s390x",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.x86_64",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.aarch64",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.ppc64le",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.s390x",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.x86_64",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-3690",
          "url": "https://www.suse.com/security/cve/CVE-2019-3690"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1148336 for CVE-2019-3690",
          "url": "https://bugzilla.suse.com/1148336"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1150734 for CVE-2019-3690",
          "url": "https://bugzilla.suse.com/1150734"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1157880 for CVE-2019-3690",
          "url": "https://bugzilla.suse.com/1157880"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1157883 for CVE-2019-3690",
          "url": "https://bugzilla.suse.com/1157883"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1160594 for CVE-2019-3690",
          "url": "https://bugzilla.suse.com/1160594"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1160764 for CVE-2019-3690",
          "url": "https://bugzilla.suse.com/1160764"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1163922 for CVE-2019-3690",
          "url": "https://bugzilla.suse.com/1163922"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-3690"
    },
    {
      "cve": "CVE-2020-8013",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8013"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can\u0027t be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.aarch64",
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.ppc64le",
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.s390x",
          "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.x86_64",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.aarch64",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.ppc64le",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.s390x",
          "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.x86_64",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.aarch64",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.ppc64le",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.s390x",
          "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.x86_64",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
          "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8013",
          "url": "https://www.suse.com/security/cve/CVE-2020-8013"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1163922 for CVE-2020-8013",
          "url": "https://bugzilla.suse.com/1163922"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:chkstat-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-1550_20210901.1550-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.s390x",
            "openSUSE Tumbleweed:permissions-config-1550_20210901-29.2.x86_64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.aarch64",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.ppc64le",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.s390x",
            "openSUSE Tumbleweed:permissions-zypp-plugin-1550_20210901.1550-29.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-8013"
    }
  ]
}

CVE-2019-3687 (GCVE-0-2019-3687)

Vulnerability from cvelistv5

Published

2020-01-24 08:25

Modified

2024-09-16 20:16

Severity ?

4.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-276 - Incorrect Default Permissions

Summary

The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to 081d081dcfaf61710bda34bc21c80c66276119aa.

References

►

URL

Tags

	https://bugzilla.suse.com/show_bug.cgi?id=1148788	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	SUSE	SUSE Linux Enterprise Server	Version: permissions < 081d081dcfaf61710bda34bc21c80c66276119aa

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:19:16.823Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1148788"
          },
          {
            "name": "openSUSE-SU-2020:0302",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SUSE Linux Enterprise Server",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "081d081dcfaf61710bda34bc21c80c66276119aa",
              "status": "affected",
              "version": "permissions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Malte Kraus of SUSE"
        }
      ],
      "datePublic": "2019-08-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the \"easy\" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to 081d081dcfaf61710bda34bc21c80c66276119aa."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276: Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-05T00:06:01",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1148788"
        },
        {
          "name": "openSUSE-SU-2020:0302",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html"
        }
      ],
      "source": {
        "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1148788",
        "defect": [
          "1148788"
        ],
        "discovery": "INTERNAL"
      },
      "title": "\"easy\" permission profile allows everyone execute dumpcap and read all network traffic",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@suse.com",
          "DATE_PUBLIC": "2019-08-30T00:00:00.000Z",
          "ID": "CVE-2019-3687",
          "STATE": "PUBLIC",
          "TITLE": "\"easy\" permission profile allows everyone execute dumpcap and read all network traffic"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SUSE Linux Enterprise Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "permissions",
                            "version_value": "081d081dcfaf61710bda34bc21c80c66276119aa"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SUSE"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Malte Kraus of SUSE"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the \"easy\" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to 081d081dcfaf61710bda34bc21c80c66276119aa."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-276: Incorrect Default Permissions"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1148788",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1148788"
            },
            {
              "name": "openSUSE-SU-2020:0302",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html"
            }
          ]
        },
        "source": {
          "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1148788",
          "defect": [
            "1148788"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2019-3687",
    "datePublished": "2020-01-24T08:25:14.454947Z",
    "dateReserved": "2019-01-03T00:00:00",
    "dateUpdated": "2024-09-16T20:16:49.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-3690 (GCVE-0-2019-3690)

Vulnerability from cvelistv5

Published

2019-12-05 15:30

Modified

2024-09-16 16:38

Severity ?

6.8 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Summary

The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges.

References

►

URL

Tags

	http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00024.html	vendor-advisory, x_refsource_SUSE
	https://bugzilla.suse.com/show_bug.cgi?id=1150734	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	SUSE	permissions	Version: unspecified < a9e1d26cd49ef9ee0c2060c859321128a6dd4230

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:19:16.801Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "openSUSE-SU-2019:2672",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00024.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1150734"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "permissions",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "a9e1d26cd49ef9ee0c2060c859321128a6dd4230",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Malte Kraus of SUSE"
        }
      ],
      "datePublic": "2019-12-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-20T15:45:08",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "name": "openSUSE-SU-2019:2672",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00024.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1150734"
        }
      ],
      "source": {
        "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1150734",
        "defect": [
          "1150733"
        ],
        "discovery": "INTERNAL"
      },
      "title": "chkstat follows untrusted symbolic links",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@suse.com",
          "DATE_PUBLIC": "2019-12-05",
          "ID": "CVE-2019-3690",
          "STATE": "PUBLIC",
          "TITLE": "chkstat follows untrusted symbolic links"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "permissions",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "a9e1d26cd49ef9ee0c2060c859321128a6dd4230"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SUSE"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Malte Kraus of SUSE"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkstat to escalate privileges."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "openSUSE-SU-2019:2672",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00024.html"
            },
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1150734",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1150734"
            }
          ]
        },
        "source": {
          "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1150734",
          "defect": [
            "1150733"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2019-3690",
    "datePublished": "2019-12-05T15:30:15.557339Z",
    "dateReserved": "2019-01-03T00:00:00",
    "dateUpdated": "2024-09-16T16:38:49.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-8013 (GCVE-0-2020-8013)

Vulnerability from cvelistv5

Published

2020-03-02 16:35

Modified

2024-09-16 17:23

Severity ?

2.2 (Low) - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Summary

A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.

References

►

URL

Tags

	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html	vendor-advisory, x_refsource_SUSE
	https://bugzilla.suse.com/show_bug.cgi?id=1163922	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

►

SUSE

SUSE Linux Enterprise Server 12

Version: permissions < 2015.09.28.1626-17.27.1

	SUSE	SUSE Linux Enterprise Server 15	Version: permissions < 20181116-9.23.1
	SUSE	SUSE Linux Enterprise Server 11	Version: permissions < 2013.1.7-0.6.12.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:48:24.923Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "openSUSE-SU-2020:0302",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1163922"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SUSE Linux Enterprise Server 12",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2015.09.28.1626-17.27.1",
              "status": "affected",
              "version": "permissions",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server 15",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "20181116-9.23.1",
              "status": "affected",
              "version": "permissions",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server 11",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2013.1.7-0.6.12.1",
              "status": "affected",
              "version": "permissions",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2020-02-28T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can\u0027t be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-19T17:09:16",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "name": "openSUSE-SU-2020:0302",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1163922"
        }
      ],
      "source": {
        "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1163922",
        "defect": [
          "1163922"
        ],
        "discovery": "INTERNAL"
      },
      "title": "permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@suse.com",
          "DATE_PUBLIC": "2020-02-28T00:00:00.000Z",
          "ID": "CVE-2020-8013",
          "STATE": "PUBLIC",
          "TITLE": "permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SUSE Linux Enterprise Server 12",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "permissions",
                            "version_value": "2015.09.28.1626-17.27.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server 15",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "permissions",
                            "version_value": "20181116-9.23.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server 11",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "permissions",
                            "version_value": "2013.1.7-0.6.12.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SUSE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can\u0027t be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "openSUSE-SU-2020:0302",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html"
            },
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1163922",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1163922"
            }
          ]
        },
        "source": {
          "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1163922",
          "defect": [
            "1163922"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2020-8013",
    "datePublished": "2020-03-02T16:35:13.188904Z",
    "dateReserved": "2020-01-27T00:00:00",
    "dateUpdated": "2024-09-16T17:23:50.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-3688 (GCVE-0-2019-3688)

Vulnerability from cvelistv5

Published

2019-10-07 14:00

Modified

2024-09-16 23:01

Severity ?

5.1 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CWE

CWE-276 - Incorrect Default Permissions

Summary

The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain persistence by changing the binary

References

►

URL

Tags

	https://bugzilla.suse.com/show_bug.cgi?id=1093414	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00024.html	vendor-advisory, x_refsource_SUSE

Impacted products

Vendor

Product

Version

►

SUSE

SUSE Linux Enterprise Server 15

Version: squid <

SUSE

SUSE Linux Enterprise Server 12

Version: squid <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T19:19:16.840Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1093414"
          },
          {
            "name": "openSUSE-SU-2019:2540",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html"
          },
          {
            "name": "openSUSE-SU-2019:2541",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html"
          },
          {
            "name": "openSUSE-SU-2019:2672",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00024.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SUSE Linux Enterprise Server 15",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThanOrEqual": "4.8-5.8.1",
              "status": "affected",
              "version": "squid",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server 12",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThanOrEqual": "3.5.21-26.17.1",
              "status": "affected",
              "version": "squid",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2018-05-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain persistence by changing the binary"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276 Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-12-11T15:06:12",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1093414"
        },
        {
          "name": "openSUSE-SU-2019:2540",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html"
        },
        {
          "name": "openSUSE-SU-2019:2541",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html"
        },
        {
          "name": "openSUSE-SU-2019:2672",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00024.html"
        }
      ],
      "source": {
        "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1093414",
        "defect": [
          "1093414"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "squid: /usr/sbin/pinger packaged with wrong permission",
      "x_generator": {
        "engine": "Vulnogram 0.0.8"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@suse.com",
          "DATE_PUBLIC": "2018-05-15T00:00:00.000Z",
          "ID": "CVE-2019-3688",
          "STATE": "PUBLIC",
          "TITLE": "squid: /usr/sbin/pinger packaged with wrong permission"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SUSE Linux Enterprise Server 15",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "squid",
                            "version_value": "4.8-5.8.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server 12",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "squid",
                            "version_value": "3.5.21-26.17.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SUSE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain persistence by changing the binary"
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.8"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-276 Incorrect Default Permissions"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1093414",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1093414"
            },
            {
              "name": "openSUSE-SU-2019:2540",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html"
            },
            {
              "name": "openSUSE-SU-2019:2541",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html"
            },
            {
              "name": "openSUSE-SU-2019:2672",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00024.html"
            }
          ]
        },
        "source": {
          "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1093414",
          "defect": [
            "1093414"
          ],
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2019-3688",
    "datePublished": "2019-10-07T14:00:39.441891Z",
    "dateReserved": "2019-01-03T00:00:00",
    "dateUpdated": "2024-09-16T23:01:09.236Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

opensuse-su-2024:11165-1

Vulnerability from csaf_opensuse

CVE-2019-3687 (GCVE-0-2019-3687)

Vulnerability from cvelistv5

CVE-2019-3690 (GCVE-0-2019-3690)

Vulnerability from cvelistv5

CVE-2020-8013 (GCVE-0-2020-8013)

Vulnerability from cvelistv5

CVE-2019-3688 (GCVE-0-2019-3688)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature