CVE-2018-16588

Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUSE Linux Enterprise 12 (SLE-12) and through 4.5-5.39 for SUSE Linux Enterprise 15 (SLE-15). Non-existing intermediate directories are created with mode 0777 during user creation. Given that they are world-writable, local attackers might use this for privilege escalation and other unspecified attacks. NOTE: this would affect non-SUSE users who took useradd.c code from a 2014-04-02 upstream pull request; however, no non-SUSE distribution is known to be affected.

CVSS v3 7.8 HIGH
CVSS v2.0 4.6 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2018-09/msg00073.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:suse:shadow:*:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:a:suse:shadow:*:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise:15.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-09-26 22:29

Updated : 2024-02-04 20:03

NVD link : CVE-2018-16588

Mitre link : CVE-2018-16588

CVE.ORG link : CVE-2018-16588

JSON object : View

Products Affected

suse

linux_enterprise
shadow

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2018-16588", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2018-09-26T22:29:00.997", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2018-09/msg00073.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUSE Linux Enterprise 12 (SLE-12) and through 4.5-5.39 for SUSE Linux Enterprise 15 (SLE-15). Non-existing intermediate directories are created with mode 0777 during user creation. Given that they are world-writable, local attackers might use this for privilege escalation and other unspecified attacks. NOTE: this would affect non-SUSE users who took useradd.c code from a 2014-04-02 upstream pull request; however, no non-SUSE distribution is known to be affected."}, {"lang": "es", "value": "Puede ocurrir un escalado de privilegios en el c\u00f3digo SUSE useradd en useradd.c, tal y como se distribuye en el paquete SUSE shadow hasta la versi\u00f3n 4.2.1-27.9.1 para SUSE Linux Enterprise 12 (SLE-12) y hasta la versi\u00f3n 4.5-5.39 para SUSE Linux Enterprise 15 (SLE-15). Se crean directorios intermedios no existentes con modo 0777 durante la creaci\u00f3n de usuarios. Teniendo en cuenta que son modificables por cualquier usuario, los atacantes locales podr\u00edan emplear esto para escalar privilegios y otros ataques sin especificar. NOTA: esto afectar\u00eda a otros usuarios fuera de SUSE que tomaron c\u00f3digo de useradd.c de una petici\u00f3n pull ascendente el 02/04/2014; sin embargo, no se conocen distribuciones externas a SUSE afectadas."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:suse:shadow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7A76BF9-4151-465F-8534-6C8C77EBE20B", "versionEndIncluding": "4.2.1-27.9.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CBC8B78D-1131-4F21-919D-8AC79A410FB9"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:suse:shadow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64AB9DE5-AB56-4904-93AD-5B0E9D9D7315", "versionEndIncluding": "4.5-5.39"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:suse:linux_enterprise:15.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1607628F-77A7-4C1F-98DF-0DC50AE8627D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}