CVE-2020-8013 — LOW (2.2) — White Hats Nepal

Vulnerability Description

A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.

CVSS Score

2.2

LOW

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Suse	Linux Enterprise Server	11
Opensuse	Leap	15.1

Related Weaknesses (CWE)

CWE-59

References

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.htmlMailing ListVendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1163922Issue TrackingVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00010.htmlMailing ListVendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1163922Issue TrackingVendor Advisory

FAQ

What is CVE-2020-8013?

CVE-2020-8013 is a vulnerability with a CVSS score of 2.2 (LOW). A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for spec...

How severe is CVE-2020-8013?

CVE-2020-8013 has been rated LOW with a CVSS base score of 2.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-8013?

Check the references section above for vendor advisories and patch information. Affected products include: Suse Linux Enterprise Server, Opensuse Leap.