CVE-2019-18901 Explained : Impact and Mitigation

A vulnerability has been discovered in the mysql-systemd-helper component of the mariadb packaging in SUSE Linux Enterprise Server 12 and SUSE Linux Enterprise Server 15, allowing local attackers to modify file permissions. This CVE affects mariadb versions earlier than 10.2.31-3.25.1 in SUSE Linux Enterprise Server 12 and versions earlier than 10.2.31-3.26.1 in SUSE Linux Enterprise Server 15.

Understanding CVE-2019-18901

This CVE involves a UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of mariadb packaging in SUSE Linux Enterprise Server 12 and 15.

What is CVE-2019-18901?

The vulnerability allows local attackers to change file permissions to 0640, impacting mariadb versions prior to specific versions in SUSE Linux Enterprise Server 12 and 15.

The Impact of CVE-2019-18901

CVSS Base Score: 5.1 (Medium Severity)
Attack Vector: Local
Attack Complexity: Low
Confidentiality Impact: Low
Integrity Impact: None
Availability Impact: Low

Technical Details of CVE-2019-18901

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The vulnerability in mysql-systemd-helper allows local attackers to set 640 permissions on arbitrary files in SUSE Linux Enterprise Server 12 and 15.

Affected Systems and Versions

Affected Systems: SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15
Affected Versions:
SUSE Linux Enterprise Server 12: mariadb versions earlier than 10.2.31-3.25.1
SUSE Linux Enterprise Server 15: mariadb versions earlier than 10.2.31-3.26.1

Exploitation Mechanism

The vulnerability can be exploited by local attackers to manipulate file permissions, potentially leading to unauthorized access.

Mitigation and Prevention

It is crucial to take immediate steps to address and prevent the exploitation of this vulnerability.

Immediate Steps to Take

Apply patches provided by SUSE for mariadb to mitigate the vulnerability.
Monitor file permissions and access controls to detect any unauthorized changes.

Long-Term Security Practices

Regularly update and patch software to address known vulnerabilities.
Implement least privilege access controls to limit the impact of potential attacks.

Patching and Updates

Ensure that all systems running mariadb in SUSE Linux Enterprise Server 12 and 15 are updated to versions that address this vulnerability.