keepalived 2.0.8 Temp File /tmp/keepalived.data information disclosure

Summaryinfo

A vulnerability has been found in keepalived 2.0.8 and classified as problematic. This vulnerability affects unknown code of the file /tmp/keepalived.data of the component Temp File Handler. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2018-19046. The attack is only possible with local access. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in keepalived 2.0.8. It has been classified as problematic. This affects an unknown part of the file /tmp/keepalived.data of the component Temp File Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

keepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon a call to PrintData or PrintStats. If a local attacker had previously created a file with the expected name (e.g., /tmp/keepalived.data or /tmp/keepalived.stats), with read access for the attacker and write access for the keepalived process, then this potentially leaked sensitive information.

The bug was discovered 11/09/2018. The weakness was released 11/08/2018 (Website). It is possible to read the advisory at bugzilla.suse.com. This vulnerability is uniquely identified as CVE-2018-19046 since 11/06/2018. Attacking locally is a requirement. A authentication is necessary for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 119854 (openSUSE Security Update : keepalived (openSUSE-2018-1575)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks and running in the context l.

Upgrading eliminates this vulnerability. A possible mitigation has been published 2 months after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (119854). Entries connected to this vulnerability are available at VDB-126589, VDB-126590 and VDB-126593. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• keepalived

Version

• 2.0.8

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion