CVE-2018-1196
First published: Tue Jan 30 2018(Updated: )
Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the "run_user" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the "run_user" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| VMware Spring Boot Tools | <=1.5.9 | |
| VMware Spring Boot Tools | =2.0.0-milestone1 | |
| VMware Spring Boot Tools | =2.0.0-milestone2 | |
| VMware Spring Boot Tools | =2.0.0-milestone3 | |
| VMware Spring Boot Tools | =2.0.0-milestone4 | |
| VMware Spring Boot Tools | =2.0.0-milestone5 | |
| VMware Spring Boot Tools | =2.0.0-milestone6 | |
| VMware Spring Boot Tools | =2.0.0-milestone7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-1196?
CVE-2018-1196 is a vulnerability in Spring Boot that allows for a symlink attack.
What is the severity of CVE-2018-1196?
The severity of CVE-2018-1196 is medium, with a severity value of 5.9.
Which versions of Spring Boot are affected by CVE-2018-1196?
Spring Boot versions 1.5.9 and 2.0.0.M1 through 2.0.0.M7 are affected by CVE-2018-1196.
How does CVE-2018-1196 allow for a symlink attack?
CVE-2018-1196 allows the "run_user" to overwrite and take ownership of any file on the system through a symlink attack.
Is there a fix for CVE-2018-1196?
Yes, to fix CVE-2018-1196, it is recommended to upgrade to the latest version of Spring Boot.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/vmware
- canonical/vmware spring boot tools
- version/vmware spring boot tools/1.5.9
- version/vmware spring boot tools/2.0.0-milestone1
- version/vmware spring boot tools/2.0.0-milestone2
- version/vmware spring boot tools/2.0.0-milestone3
- version/vmware spring boot tools/2.0.0-milestone4
- version/vmware spring boot tools/2.0.0-milestone5
- version/vmware spring boot tools/2.0.0-milestone6
- version/vmware spring boot tools/2.0.0-milestone7