CVE-2019-18192
Current Description
GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365.
Basic Data
| Published | October 17, 2019 |
|---|
| Last Modified | October 22, 2019 |
|---|
| Assigner | cve@mitre.org |
|---|
| Data Type | CVE |
|---|
| Data Format | MITRE |
|---|
| Data Version | 4.0 |
|---|
| Problem Type | CWE-732 |
|---|
| CVE Data Version | 4.0 |
|---|
Base Metric V2
| CVSS 2 - Version | 2.0 |
|---|
| CVSS 2 - Vector String | AV:L/AC:L/Au:N/C:P/I:P/A:P |
|---|
| CVSS 2 - Access Vector | LOCAL |
|---|
| CVSS 2 - Access Complexity | LOW |
|---|
| CVSS 2 - Authentication | NONE |
|---|
| CVSS 2 - Confidentiality Impact | PARTIAL |
|---|
| CVSS 2 - Availability Impact | PARTIAL |
|---|
| CVSS 2 - Base Score | 4.6 |
|---|
| Severity | MEDIUM |
|---|
| Exploitability Score | 3.9 |
|---|
| Impact Score | 6.4 |
|---|
| Obtain All Privilege | false |
|---|
| Obtain User Privilege | false |
|---|
| Obtain Other Privilege | false |
|---|
Base Metric V3
No data provided.
Configurations
-
OR - Configuration 1
| Cpe Version | Part | Vendor | Product | Version | Update | Edition | Language | SW Edition | Target SW | Target HW | Other | Version Start Including | Version End Including | Version Start Excluding | Version End Excluding |
|---|
| 2.3 | Application | Gnu | Guix | 1.0.1 | * | * | * | * | * | * | * | | | | |
Vulnerable Software List
| Vendor | Product | Versions |
| Gnu
|
Guix |
1.0.1 |
References
| Name | Source | URL | Tags |
|---|
| [oss-security] 20191017 CVE-2019-18192: Insecure permissions on Guix profile directory | http://www.openwall.com/lists/oss-security/2019/10/17/3 | MLIST | Mailing List Patch Third Party Advisory |
| https://issues.guix.gnu.org/issue/37744 | https://issues.guix.gnu.org/issue/37744 | MISC | Exploit Issue Tracking Third Party Advisory |
Follow @discotekdotca