CVE-2015-0796: open build service source server symlink exploitation via source patch
In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, which could allow buildservice users to break of confinement or cause denial of service attacks on the source service.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0796?
CVE-2015-0796 has a medium severity rating, as it can lead to denial of service attacks or the breaking of confinement.
How do I fix CVE-2015-0796?
To fix CVE-2015-0796, upgrade to open buildservice versions 2.6.3, 2.5.7, or 2.4.8 or later.
What versions of open buildservice are affected by CVE-2015-0796?
CVE-2015-0796 affects open buildservice versions prior to 2.6.3, 2.5.7, and 2.4.8.
Can CVE-2015-0796 allow unauthorized access?
Yes, CVE-2015-0796 could potentially allow buildservice users to escape confinement, leading to unauthorized access.
What kind of files can CVE-2015-0796 generate that pose a risk?
CVE-2015-0796 can generate non-standard files such as symlinks or device nodes, which could introduce security vulnerabilities.