SuSE Linux Enterprise Server up to 081d081dcfaf61710bda34bc21c80c66276119aa Permission Package Sniffing default permission

CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
3.8 | $0-$5k | 0.00 |
A vulnerability was found in SuSE Linux Enterprise Server up to 081d081dcfaf61710bda34bc21c80c66276119aa (Operating System). It has been rated as problematic. Affected by this issue is an unknown functionality of the component Permission Package. The manipulation with an unknown input leads to a default permission vulnerability (Sniffing). Using CWE to declare the problem leads to CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. Impacted is confidentiality. CVE summarizes:
The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to 081d081dcfaf61710bda34bc21c80c66276119aa.
The weakness was presented 01/24/2020 as Bug 1148788 as confirmed bug report (Bugzilla). The advisory is available at bugzilla.suse.com. This vulnerability is handled as CVE-2019-3687 since 01/03/2019. Local access is required to approach this attack. The successful exploitation needs a simple authentication. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 01/25/2020). This vulnerability is assigned to T1222 by the MITRE ATT&CK project.
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
See VDB-67732 for similar entry.
Product
Type
Vendor
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 3.8VulDB Meta Temp Score: 3.8
VulDB Base Score: 3.3
VulDB Temp Score: 3.3
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 4.0
NVD Vector: 🔍
CNA Base Score: 4.0
CNA Vector (SUSE): 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Name: SniffingClass: Default permission / Sniffing
CWE: CWE-276 / CWE-266
CAPEC: 🔍
ATT&CK: 🔍
Local: Yes
Remote: No
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: no mitigation knownStatus: 🔍
0-Day Time: 🔍
Timeline
01/03/2019 🔍01/24/2020 🔍
01/25/2020 🔍
03/26/2024 🔍
Sources
Vendor: suse.comAdvisory: Bug 1148788
Status: Confirmed
CVE: CVE-2019-3687 (🔍)
See also: 🔍
Entry
Created: 01/25/2020 08:41 AMUpdated: 03/26/2024 07:54 AM
Changes: 01/25/2020 08:41 AM (42), 01/25/2020 08:46 AM (12), 03/26/2024 07:54 AM (34)
Complete: 🔍
Cache ID: 18:D46:40
No comments yet. Languages: en.
Please log in to comment.