CVE-2018-17955: Static tempfile name allows overwriting of arbitrary files
Published Mar 15, 2019
·Updated
In yast2-multipath before version 4.1.1 a static temporary filename allows local attackers to overwrite files on systems without symlink protection
Affected Software
1 affected component
openSUSE Yast2-multipath<4.1.1
Remediation
Patch Available
Event History
Mar 15, 2019
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-17955?
CVE-2018-17955 is considered a medium severity vulnerability due to its potential for local file overwrite attacks.
2
How do I fix CVE-2018-17955?
To fix CVE-2018-17955, update yast2-multipath to version 4.1.1 or later.
3
Who is affected by CVE-2018-17955?
Users of yast2-multipath versions prior to 4.1.1 on openSUSE systems are at risk from CVE-2018-17955.
4
What type of attack does CVE-2018-17955 allow?
CVE-2018-17955 allows local attackers to overwrite files due to the use of a static temporary filename.
5
Is symlink protection related to CVE-2018-17955?
Yes, CVE-2018-17955 affects systems that do not have symlink protection enabled.