CVE-2020-15396: Race Condition
In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to root.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15396?
CVE-2020-15396 has been classified with a medium severity level.
How do I fix CVE-2020-15396?
To fix CVE-2020-15396, ensure that you upgrade to the version of HylaFAX+ greater than 7.0.2 or apply any relevant patches provided by your distribution.
Who is affected by CVE-2020-15396?
CVE-2020-15396 affects users of HylaFAX+ versions up to and including 7.0.2 and various versions of HylaFAX Enterprise, as well as specific Fedora and openSUSE distributions.
What type of attack can be executed using CVE-2020-15396?
An attacker can escalate their privileges to root by exploiting a race condition in the faxsetup utility.
Is CVE-2020-15396 a local or remote vulnerability?
CVE-2020-15396 is a local vulnerability that requires access to the affected system to exploit.