CVE-2018-19638 : In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have o

In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files.

Published 2019-03-05 16:29:00

Updated 2019-05-08 21:29:01

Source SUSE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2018-19638

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 11 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-19638

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.3	LOW	AV:L/AC:M/Au:N/C:N/I:P/A:P	3.4	4.9	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial
2.2	LOW	CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N	0.8	1.4	SUSE
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None
4.7	MEDIUM	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N	1.0	3.6	NIST
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2018-19638

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Assigned by: nvd@nist.gov (Primary)

CWE-377 Insecure Temporary File

Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Assigned by: meissner@suse.de (Secondary)

References for CVE-2018-19638

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00018.html

[security-announce] openSUSE-SU-2019:1351-1: important: Security update

CVEs referencing this url
https://bugzilla.suse.com/show_bug.cgi?id=1118460

Bug 1118460 – VUL-1: CVE-2018-19638: supportutils: User can overwrite arbitrary log files in support tar
Exploit;Issue Tracking;Vendor Advisory

Products affected by CVE-2018-19638

Opensuse » Supportutils
Versions before (<) 3.1-5.7.1
cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2018-19638

Exploit prediction scoring system (EPSS) score for CVE-2018-19638

CVSS scores for CVE-2018-19638

CWE ids for CVE-2018-19638

References for CVE-2018-19638

Products affected by CVE-2018-19638