CVE-2020-8013: permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim

Published Mar 2, 2020

Updated

A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.

Affected Software

4 affected components

SUSE Linux Enterprise Server=11

SUSE Linux Enterprise Server=12

SUSE Linux Enterprise Server=15

openSUSE Leap=15.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade chkstat (SUSE Linux Enterprise Server permissions) to a version that resolves this vulnerability.
Fixed in 2013.1.7-0.6.12.1
Upgrade
Upgrade chkstat (SUSE Linux Enterprise Server permissions) to a version that resolves this vulnerability.
Fixed in 20181116-9.23.1
Upgrade
Upgrade chkstat (SUSE Linux Enterprise Server permissions) to a version that resolves this vulnerability.
Fixed in 2015.09.28.1626-17.27.1

Event History

Mar 2, 2020

CVE Published

via MITRE·04:35 PM

Data Sourced

via MITRE·04:35 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2020-8013?

CVE-2020-8013 is a UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11.

What is the severity of CVE-2020-8013?

The severity of CVE-2020-8013 is low.

How does CVE-2020-8013 affect SUSE Linux Enterprise Server?

CVE-2020-8013 affects SUSE Linux Enterprise Server versions 11, 12, and 15.

How can I fix CVE-2020-8013?

To fix CVE-2020-8013, it is recommended to apply the necessary patches provided by SUSE Linux.

Where can I find more information about CVE-2020-8013?

You can find more information about CVE-2020-8013 in the following references: [1] http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.html [2] https://bugzilla.suse.com/show_bug.cgi?id=1163922