CVE-2020-8013: permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim
First published: Mon Mar 02 2020(Updated: )
A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.
Credit: meissner@suse.de
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SUSE Linux Enterprise Server | =11 | |
| SUSE Linux Enterprise Server | =12 | |
| SUSE Linux Enterprise Server | =15 | |
| openSUSE Leap | =15.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-8013?
CVE-2020-8013 is a UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11.
What is the severity of CVE-2020-8013?
The severity of CVE-2020-8013 is low.
How does CVE-2020-8013 affect SUSE Linux Enterprise Server?
CVE-2020-8013 affects SUSE Linux Enterprise Server versions 11, 12, and 15.
How can I fix CVE-2020-8013?
To fix CVE-2020-8013, it is recommended to apply the necessary patches provided by SUSE Linux.
Where can I find more information about CVE-2020-8013?
You can find more information about CVE-2020-8013 in the following references: [1] http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html [2] https://bugzilla.suse.com/show_bug.cgi?id=1163922
- agent/references
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/suse
- canonical/suse linux enterprise server
- version/suse linux enterprise server/11
- version/suse linux enterprise server/12
- version/suse linux enterprise server/15
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/15.1