Overview
- Description
- The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain persistence by changing the binary
- Source
- meissner@suse.de
- NVD status
- Modified
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 7.1
- Impact score
- 5.2
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 6.6
- Impact score
- 9.2
- Exploitability score
- 3.9
- Vector string
- AV:L/AC:L/Au:N/C:N/I:C/A:C
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:12:sp1:*:*:ltss:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4BF3B54D-9CE7-44A3-89FB-7747FADBD361"
},
{
"criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:12:sp2:*:*:ltss:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F45BC40-F836-447D-A5B3-8A7FCF64A82E"
},
{
"criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:12:sp3:*:*:ltss:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC4D0498-D6FB-4A73-B053-895AC60A4DEB"
},
{
"criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:15:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "873082AA-2F7B-44C8-89D2-4DD48673BAE9"
},
{
"criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:15:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7642C831-6063-4405-A352-431CE374458A"
}
],
"operator": "OR"
}
]
}
]