CVE-2019-3693 : A symlink following vulnerability in the packaging of mailman in SUSE Linux Ente

A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.

Published 2020-01-24 10:15:12

Updated 2022-11-10 04:42:16

Source SUSE

View at NVD, CVE.org

Products affected by CVE-2019-3693

Suse » Mailman
Versions before (<) 2.1.17-3.11.1
cpe:2.3:a:suse:mailman:*:*:*:*:*:*:*:*
Matching versions
When used together with: Suse » Linux Enterprise Server » Version: 12
Suse » Mailman
Versions up to, including, (<=) 2.1.29-lp151.2.14
cpe:2.3:a:suse:mailman:*:*:*:*:*:*:*:*
Matching versions
When used together with: Opensuse » Leap » Version: 15.1
Suse » Mailman
Versions before (<) 2.1.15-9.6.15.1
cpe:2.3:a:suse:mailman:*:*:*:*:*:*:*:*
Matching versions
When used together with: Suse » Linux Enterprise Server » Version: 11
Opensuse » Backports Sle » Version: 15.0 Update SP1
cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2019-3693

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-3693

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.7	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	2.5	5.2	SUSE
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-3693

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Assigned by:
- meissner@suse.de (Primary)
- nvd@nist.gov (Secondary)

References for CVE-2019-3693

http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00000.html

[security-announce] openSUSE-SU-2020:0156-1: moderate: Security update f
Mailing List;Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00059.html

[security-announce] openSUSE-SU-2020:0148-1: moderate: Security update f
Mailing List;Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1154328

Bug 1154328 – VUL-0: CVE-2019-3693: mailman: LPE from wwwrun to root; ability to chgrp arbitrary files to mailman
Issue Tracking;Vendor Advisory

Jump to

Vulnerability Details : CVE-2019-3693

Products affected by CVE-2019-3693

Exploit prediction scoring system (EPSS) score for CVE-2019-3693

CVSS scores for CVE-2019-3693

CWE ids for CVE-2019-3693

References for CVE-2019-3693