CVE-2018-6557 — Link Following in Base-files

CWE-59 — Link Following5 documents5 sources
Severity
7.0HIGHNVD
EPSS
0.1%
top 84.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Ubuntu Base-filesBase-files Project Base-filesCanonical Ubuntu Linux+1 more
Timeline
PublishedAug 21
Latest updateMay 14

Description

The MOTD update script in the base-files package in Ubuntu 18.04 LTS before 10.1ubuntu2.2, and Ubuntu 18.10 before 10.1ubuntu6 incorrectly handled temporary files. A local attacker could use this issue to cause a denial of service, or possibly escalate privileges if kernel symlink restrictions were disabled.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5ubuntu/base-filesunspecified — 10.1ubuntu2.2
▶Ubuntubase-files_project/base-files< 10.1ubuntu2.2

Also affects: Ubuntu Linux 18.04, 18.10

🔴Vulnerability Details

2
GHSA
GHSA-vfrm-87wr-xvjf: The MOTD update script in the base-files package in Ubuntu 18↗2022-05-14
▶
OSV
CVE-2018-6557: The MOTD update script in the base-files package in Ubuntu 18↗2018-08-21
▶

📋Vendor Advisories

2
Ubuntu
base-files vulnerability↗2018-08-21
▶
Debian
CVE-2018-6557: base-files - The MOTD update script in the base-files package in Ubuntu 18.04 LTS before 10.1...↗2018
▶