REDHAT-BUG-2490283: Medium severity attr attr vulnerability
attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr utility that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr is invoked by a privileged process over an attacker-controlled path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
attr/getfattrto a version that resolves this vulnerability.Fixed in 2.6.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2490283?
The severity of REDHAT-BUG-2490283 is medium with a score of 4.
How can I mitigate REDHAT-BUG-2490283?
To mitigate REDHAT-BUG-2490283, upgrade to attr version 2.6.0 or later to eliminate the symlink traversal vulnerability.
What vulnerability is addressed by REDHAT-BUG-2490283?
REDHAT-BUG-2490283 addresses a symlink traversal vulnerability in the getfattr utility that may allow local privilege escalation.
Who is affected by REDHAT-BUG-2490283?
Local attackers who can control pathname components are potentially affected by REDHAT-BUG-2490283.
What is the risk level associated with REDHAT-BUG-2490283?
The risk level associated with REDHAT-BUG-2490283 is rated as 19, indicating a medium level of risk.