A vulnerability, which was classified as critical, was found in CISOfy Lynis up to 2.x. This affects an unknown functionality of the component Access Control. The manipulation with an unknown input leads to a toctou vulnerability. CWE is classifying the issue as CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks.

The weakness was disclosed 06/18/2020 (Website). It is possible to read the advisory at cisofy.com. This vulnerability is uniquely identified as CVE-2020-13882 since 06/06/2020. Attacking locally is a requirement. The successful exploitation needs a authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 3.0.0 eliminates this vulnerability.

Productinfo

Vendor

• CISOfy

Name

• Lynis

Version

• 2.x

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion