CVE-2020-8013

{"containers": {"cna": {"affected": [{"product": "SUSE Linux Enterprise Server 12", "vendor": "SUSE", "versions": [{"lessThan": "2015.09.28.1626-17.27.1", "status": "affected", "version": "permissions", "versionType": "custom"}]}, {"product": "SUSE Linux Enterprise Server 15", "vendor": "SUSE", "versions": [{"lessThan": "20181116-9.23.1", "status": "affected", "version": "permissions", "versionType": "custom"}]}, {"product": "SUSE Linux Enterprise Server 11", "vendor": "SUSE", "versions": [{"lessThan": "2013.1.7-0.6.12.1", "status": "affected", "version": "permissions", "versionType": "custom"}]}], "datePublic": "2020-02-28T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-11-19T17:09:16.000Z", "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse"}, "references": [{"name": "openSUSE-SU-2020:0302", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1163922"}], "source": {"advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1163922", "defect": ["1163922"], "discovery": "INTERNAL"}, "title": "permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@suse.com", "DATE_PUBLIC": "2020-02-28T00:00:00.000Z", "ID": "CVE-2020-8013", "STATE": "PUBLIC", "TITLE": "permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SUSE Linux Enterprise Server 12", "version": {"version_data": [{"version_affected": "<", "version_name": "permissions", "version_value": "2015.09.28.1626-17.27.1"}]}}, {"product_name": "SUSE Linux Enterprise Server 15", "version": {"version_data": [{"version_affected": "<", "version_name": "permissions", "version_value": "20181116-9.23.1"}]}}, {"product_name": "SUSE Linux Enterprise Server 11", "version": {"version_data": [{"version_affected": "<", "version_name": "permissions", "version_value": "2013.1.7-0.6.12.1"}]}}]}, "vendor_name": "SUSE"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}]}, "references": {"reference_data": [{"name": "openSUSE-SU-2020:0302", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html"}, {"name": "https://bugzilla.suse.com/show_bug.cgi?id=1163922", "refsource": "CONFIRM", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1163922"}]}, "source": {"advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1163922", "defect": ["1163922"], "discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T09:48:24.923Z"}, "title": "CVE Program Container", "references": [{"name": "openSUSE-SU-2020:0302", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1163922"}]}]}, "cveMetadata": {"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "cveId": "CVE-2020-8013", "datePublished": "2020-03-02T16:35:13.188Z", "dateReserved": "2020-01-27T00:00:00.000Z", "dateUpdated": "2024-09-16T17:23:50.476Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "SUSE Linux Enterprise Server 12", "vendor": "SUSE", "versions": [{"lessThan": "2015.09.28.1626-17.27.1", "status": "affected", "version": "permissions", "versionType": "custom"}]}, {"product": "SUSE Linux Enterprise Server 15", "vendor": "SUSE", "versions": [{"lessThan": "20181116-9.23.1", "status": "affected", "version": "permissions", "versionType": "custom"}]}, {"product": "SUSE Linux Enterprise Server 11", "vendor": "SUSE", "versions": [{"lessThan": "2013.1.7-0.6.12.1", "status": "affected", "version": "permissions", "versionType": "custom"}]}], "source": "meissner@suse.de"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:*:*:*:*:*:*:*", "matchCriteriaId": "F26C5EBA-147C-4CED-B4BA-F3BF4EA2F593", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:*:*:*:*:*:*:*", "matchCriteriaId": "F922115C-1907-4F65-9F23-3E63A8BCD4A7", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:*:*:*", "matchCriteriaId": "70A029CD-2AC4-4877-B1A4-5C72B351BA27", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1."}, {"lang": "es", "value": "Una vulnerabilidad de tipo UNIX Symbolic Link (Symlink) Following en chkstat de SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 establece permisos previstos para binarios espec\u00edficos en otros binarios porque segu\u00eda err\u00f3neamente enlaces simb\u00f3licos. Los atacantes no pueden controlar los enlaces simb\u00f3licos en los sistemas predeterminados, por lo que la explotaci\u00f3n es dif\u00edcil. Este problema afecta: Los permisos de SUSE Linux Enterprise Server 12 versiones anteriores a 2015.09.28.1626-17.27.1. Los permisos de SUSE Linux Enterprise Server 15 versiones anteriores a 20181116-9.23.1. Los permisos de SUSE Linux Enterprise Server 11 versiones anteriores a 2013.1.7-0.6.12.1."}], "id": "CVE-2020-8013", "lastModified": "2026-06-17T03:25:47.060", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.9, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 1.4, "source": "meissner@suse.de", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-03-02T17:15:19.593", "references": [{"source": "meissner@suse.de", "tags": ["Mailing List", "Vendor Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html"}, {"source": "meissner@suse.de", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1163922"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Vendor Advisory"], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1163922"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "meissner@suse.de", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-59"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}

{}