CVE-2020-8013

permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim

State: Published
Severity: 2.2 Low
Published: Mar 2, 2020
Updated: Sep 16, 2024
Reserved: Jan 27, 2020

Description

A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.

Scores

CVSS	Score	Vector	Source
3.1	2.2 Low	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N	suse

Weaknesses

CWE-59 Improper Link Resolution Before File Access ('Link Following')

Affected Products

Product	Versions
SUSE Linux Enterprise Server 12SUSE	permissions to before 2015.09.28.1626-17.27.1Affected
SUSE Linux Enterprise Server 15SUSE	permissions to before 20181116-9.23.1Affected
SUSE Linux Enterprise Server 11SUSE	permissions to before 2013.1.7-0.6.12.1Affected

References

openSUSE-SU-2020:0302vendor-advisory
https://bugzilla.suse.com/show_bug.cgi?id=1163922

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.