CVE-2019-3688 — Incorrect Default Permissions in Linux Enterprise Server 12

CWE-276 — Incorrect Default Permissions4 documents4 sources
Severity
7.1HIGHNVD
CNA5.1
EPSS
0.1%
top 82.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Suse Linux Enterprise Server 12Suse Linux Enterprise Server 15Suse Linux Enterprise Server
Timeline
PublishedOct 7
Latest updateMay 24

Description

The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain persistence by changing the binary

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 1.8 | Impact: 5.2

Affected Packages3 packages

▶CVEListV5suse/suse_linux_enterprise_server_12squid — 3.5.21-26.17.1
▶CVEListV5suse/suse_linux_enterprise_server_15squid — 4.8-5.8.1

🔴Vulnerability Details

2
GHSA
GHSA-mx4x-652m-w4fw: The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4↗2022-05-24
▶
CVEList
squid: /usr/sbin/pinger packaged with wrong permission↗2019-10-07
▶

📋Vendor Advisories

1
Debian
CVE-2019-3688: squid - The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server ...↗2019
▶