CVE-2016-1602: Code Injection

Published Mar 23, 2017

Updated

A code injection in the supportconfig data collection tool in supportutils in SUSE Linux Enterprise Server 12 and 12-SP1 and SUSE Linux Enterprise Desktop 12 and 12-SP1 could be used by local attackers to execute code as the user running supportconfig (usually root).

Affected Software

4 affected components

SUSE Linux Enterprise Desktop=12

SUSE Linux Enterprise Desktop=12-sp1

SUSE Linux Enterprise Server=12-sp1

SUSE SUSE Linux Enterprise Server=12

Event History

Mar 23, 2017

CVE Published

via MITRE·06:36 AM

Data Sourced

via MITRE·06:36 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2016-1602?

CVE-2016-1602 is rated as a high severity vulnerability due to the potential for local code execution by attackers.

How do I fix CVE-2016-1602?

To mitigate CVE-2016-1602, update the supportutils package to the latest version provided by SUSE.

Who is affected by CVE-2016-1602?

CVE-2016-1602 affects users running SUSE Linux Enterprise Server and Desktop versions 12 and 12-SP1.

What type of vulnerability is CVE-2016-1602?

CVE-2016-1602 is a code injection vulnerability in the supportconfig data collection tool.

Can CVE-2016-1602 be exploited remotely?

No, CVE-2016-1602 requires local access, as it can only be exploited by authenticated local users.