oddjob Package up to 0.34.4 mkhomedir Tool /etc/skel path traversal

Summaryinfo

A vulnerability was found in oddjob Package up to 0.34.4. It has been classified as critical. This impacts an unknown function of the file /etc/skel of the component mkhomedir Tool. The manipulation leads to path traversal. This vulnerability is referenced as CVE-2020-10737. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in oddjob Package up to 0.34.4 and classified as problematic. This issue affects an unknown code block of the file /etc/skel of the component mkhomedir Tool. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home's user without properly checking the homedir path. This flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then has its ownership transferred to the new home directory's unprivileged user.

The weakness was published 05/27/2020 as not defined bug report (Bugzilla). It is possible to read the advisory at bugzilla.redhat.com. The identification of this vulnerability is CVE-2020-10737 since 03/20/2020. The exploitation is known to be difficult. Attacking locally is a requirement. The exploitation requires an enhanced level of successful authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 276414 (TencentOS Server 3: oddjob (TSSA-2022:0053)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.34.5 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (276414). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• oddjob Package

Version

• 0.34.0
• 0.34.1
• 0.34.2
• 0.34.3
• 0.34.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion