CVE-2019-3690 : What You Need to Know

CVE-2019-3690, titled 'chkstat follows untrusted symbolic links,' is a vulnerability in the permissions package of SUSE that allowed local attackers to exploit privileges by controlling a path that the chkstat tool traverses. This CVE was published on December 5, 2019.

Understanding CVE-2019-3690

This section provides insights into the nature and impact of the CVE.

What is CVE-2019-3690?

The vulnerability in the chkstat tool of the permissions package allowed local attackers to escalate privileges by manipulating the path chkstat follows, due to improper handling of symbolic links.

The Impact of CVE-2019-3690

The vulnerability posed a medium severity risk with a CVSS base score of 6.8. It had a high impact on confidentiality and low impact on integrity, requiring no special privileges for exploitation.

Technical Details of CVE-2019-3690

Explore the technical aspects of the CVE in this section.

Vulnerability Description

Before the fix in commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230, the chkstat tool followed symlinks, enabling attackers to exploit privileges by controlling the path chkstat traverses.

Affected Systems and Versions

Vendor: SUSE
Product: permissions
Versions affected: unspecified
Versions less than: a9e1d26cd49ef9ee0c2060c859321128a6dd4230

Exploitation Mechanism

The vulnerability allowed local attackers to manipulate symbolic links to escalate privileges by influencing the path chkstat follows.

Mitigation and Prevention

Learn how to mitigate and prevent the exploitation of this vulnerability.

Immediate Steps to Take

Update the permissions package to a version beyond a9e1d26cd49ef9ee0c2060c859321128a6dd4230.
Review and implement additional security measures provided in the fix.

Long-Term Security Practices

Regularly review and update software packages to address known vulnerabilities.
Implement least privilege principles to limit the impact of potential exploits.

Patching and Updates

Apply patches and updates provided by SUSE to address the vulnerability in the permissions package.