CVE-2014-3986
published 2014-06-08CVE-2014-3986: include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.*.unsorted file with an…
PriorityP49low3.3CVSS 2.0
AVLACMAuNCNIPAP
EPSS
0.34%
26.7th percentile
include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.*.unsorted file with an easily determined name.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisofy | lynis | <= 1.5.4 | — |
| cisofy | lynis | — | — |
| cisofy | lynis | — | — |
| cisofy | lynis | — | — |
| cisofy | lynis | — | — |
| cisofy | lynis | >= 0 < 1.5.5-1 | 1.5.5-1 |
| cisofy | lynis | >= 0 < 1.5.5-1 | 1.5.5-1 |
| cisofy | lynis | >= 0 < 1.5.5-1 | 1.5.5-1 |
| cisofy | lynis | >= 0 < 1.5.5-1 | 1.5.5-1 |
| debian | lynis | < lynis 1.5.5-1 (bookworm) | lynis 1.5.5-1 (bookworm) |
CVSS provenance
nvdv2.03.3LOWAV:L/AC:M/Au:N/C:N/I:P/A:P
osv3.3LOW
vendor_debian3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-86cx-5fmh-r6xm: include/tests_webservers in Lynis before 1
ghsa_unreviewed·2022-05-17
CVE-2014-3986 [LOW] CWE-59 GHSA-86cx-5fmh-r6xm: include/tests_webservers in Lynis before 1
include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.*.unsorted file with an easily determined name.
OSV
CVE-2014-3986: include/tests_webservers in Lynis before 1
osv·2014-06-08·CVSS 3.3
CVE-2014-3986 [LOW] CVE-2014-3986: include/tests_webservers in Lynis before 1
include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.*.unsorted file with an easily determined name.
Debian
CVE-2014-3986: lynis - include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite a...
vendor_debian·2014·CVSS 3.3
CVE-2014-3986 [LOW] CVE-2014-3986: lynis - include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite a...
include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.*.unsorted file with an easily determined name.
Scope: local
bookworm: resolved (fixed in 1.5.5-1)
bullseye: resolved (fixed in 1.5.5-1)
forky: resolved (fixed in 1.5.5-1)
sid: resolved (fixed in 1.5.5-1)
trixie: resolved (fixed in 1.5.5-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-3982 CVE-2014-3986 lynis: insecure temporary file issues leading to privilege escalation [epel-6]
bugzilla·2014-06-05·CVSS 3.3
CVE-2014-3982 [LOW] CVE-2014-3982 CVE-2014-3986 lynis: insecure temporary file issues leading to privilege escalation [epel-6]
CVE-2014-3982 CVE-2014-3986 lynis: insecure temporary file issues leading to privilege escalation [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Bugzilla
CVE-2014-3982 CVE-2014-3986 lynis: insecure temporary file issues leading to privilege escalation [fedora-all]
bugzilla·2014-06-05·CVSS 3.3
CVE-2014-3982 [LOW] CVE-2014-3982 CVE-2014-3986 lynis: insecure temporary file issues leading to privilege escalation [fedora-all]
CVE-2014-3982 CVE-2014-3986 lynis: insecure temporary file issues leading to privilege escalation [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
N
Bugzilla
CVE-2014-3982 CVE-2014-3986 lynis: insecure temporary file issues leading to privilege escalation
bugzilla·2014-06-05·CVSS 3.3
CVE-2014-3982 [LOW] CVE-2014-3982 CVE-2014-3986 lynis: insecure temporary file issues leading to privilege escalation
CVE-2014-3982 CVE-2014-3986 lynis: insecure temporary file issues leading to privilege escalation
It was reported[1] lynis, a security auditing tool, uses a predictable filename in /tmp/. As lynis must be run as root, a local attacker could possibly use this flaw to perform a symbolic link attack and escalate their privileges to root.
The report may be referring to the following:
39 if [ "${OS}" = "AIX" ]; then
40 TMPFILE=/tmp/lynis.$$
Testing on Fedora 20 revealed /tmp/ffiYFc1nZ was used across multiple runs; however, this name does not appear in the source and may be related to something else.
[1] http://seclists.org/fulldisclosure/2014/Jun/21
CVE request: http://www.openwall.com/lists/oss-security/2014/06/05/14
Discussion:
Created lynis tracking bugs for this issue:
Affects: fe
http://cisofy.com/files/lynis-1.5.5.tar.gzhttp://openwall.com/lists/oss-security/2014/06/05/14http://openwall.com/lists/oss-security/2014/06/06/12http://openwall.com/lists/oss-security/2014/06/07/3http://seclists.org/fulldisclosure/2014/Jun/21http://cisofy.com/files/lynis-1.5.5.tar.gzhttp://openwall.com/lists/oss-security/2014/06/05/14http://openwall.com/lists/oss-security/2014/06/06/12http://openwall.com/lists/oss-security/2014/06/07/3http://seclists.org/fulldisclosure/2014/Jun/21
2014-06-08
Published