CVE-2019-3688: squid: /usr/sbin/pinger packaged with wrong permission
The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain persistence by changing the binary
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-3688?
CVE-2019-3688 is a vulnerability in the /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server.
What is the severity of CVE-2019-3688?
CVE-2019-3688 has a severity rating of 7.1 (high).
How can an attacker exploit CVE-2019-3688?
To exploit CVE-2019-3688, an attacker would need to compromise the squid user.
How can I fix CVE-2019-3688?
To fix CVE-2019-3688, update to a version of SUSE Linux Enterprise Server that includes the patch.
Where can I find more information about CVE-2019-3688?
You can find more information about CVE-2019-3688 in the references provided: [Link 1](http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.html), [Link 2](http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html), [Link 3](http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00024.html).