CVE-2019-3688 : Security Advisory and Response

In previous versions of SUSE Linux Enterprise Server 15 and 12, a vulnerability in the /usr/sbin/pinger binary packaged with squid allowed attackers to gain persistence by altering the binary.

Understanding CVE-2019-3688

This CVE involves incorrect default permissions in the squid package on SUSE Linux Enterprise Server.

What is CVE-2019-3688?

The vulnerability in the /usr/sbin/pinger binary in SUSE Linux Enterprise Server 15 and 12 allowed attackers to exploit the squid user's compromised permissions to establish persistence.

The Impact of CVE-2019-3688

The vulnerability had a CVSS base score of 5.1, with low attack complexity and vector being local. It posed a medium severity risk with low availability and integrity impact.

Technical Details of CVE-2019-3688

The technical details of the vulnerability in the squid package on SUSE Linux Enterprise Server.

Vulnerability Description

The /usr/sbin/pinger binary in SUSE Linux Enterprise Server 15 and 12 had incorrect permissions (squid:root, 0750), enabling attackers to modify the binary and maintain persistence.

Affected Systems and Versions

SUSE Linux Enterprise Server 15 up to version 4.8-5.8.1
SUSE Linux Enterprise Server 12 up to version 3.5.21-26.17.1

Exploitation Mechanism

Attackers could exploit compromised squid user permissions to alter the /usr/sbin/pinger binary and establish persistence.

Mitigation and Prevention

Steps to mitigate and prevent the CVE-2019-3688 vulnerability.

Immediate Steps to Take

Apply patches provided by SUSE to fix the incorrect permissions issue.
Monitor for any unauthorized changes to critical system binaries.

Long-Term Security Practices

Regularly update and patch software to address security vulnerabilities.
Implement least privilege access controls to limit the impact of compromised accounts.
Conduct security audits to identify and remediate misconfigurations.

Patching and Updates

SUSE released patches to correct the permissions of the /usr/sbin/pinger binary in affected versions of SUSE Linux Enterprise Server.