SuSE Linux Enterprise Module for SUSE Manager Server Salt access control

Summaryinfo

A vulnerability, which was classified as critical, was found in SuSE Linux Enterprise Module for SUSE Manager Server, Manager Proxy, Manager Retail Branch Server and Manager Server. This affects an unknown part of the component Salt Handler. The manipulation results in access control. This vulnerability is cataloged as CVE-2020-8028. The attack must be initiated from a local position. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in SuSE Linux Enterprise Module for SUSE Manager Server, Manager Proxy, Manager Retail Branch Server and Manager Server (Operating System) (affected version not known). It has been classified as critical. Affected is some unknown functionality of the component Salt Handler. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A Improper Access Control vulnerability in the configuration of salt of SUSE Linux Enterprise Module for SUSE Manager Server 4.1, SUSE Manager Proxy 4.0, SUSE Manager Retail Branch Server 4.0, SUSE Manager Server 3.2, SUSE Manager Server 4.0 allows local users to escalate to root on every system managed by SUSE manager. On the managing node itself code can be executed as user salt, potentially allowing for escalation to root there. This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 google-gson versions prior to 2.8.5-3.4.3, httpcomponents-client-4.5.6-3.4.2, httpcomponents-. SUSE Manager Proxy 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Retail Branch Server 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Server 3.2 salt-netapi-client versions prior to 0.16.0-4.14.1, spacewalk-. SUSE Manager Server 4.0 release-notes-susemanager versions prior to 4.0.9-3.54.1.

The weakness was shared 09/17/2020 as Bug 1175884 as not defined bug report (Bugzilla). The advisory is available at bugzilla.suse.com. This vulnerability is traded as CVE-2020-8028 since 01/27/2020. Local access is required to approach this attack. A authentication is required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• SuSE

Name

• Linux Enterprise Module for SUSE Manager Server
• Manager Proxy
• Manager Retail Branch Server
• Manager Server

License

• open-source

Website

• Vendor: https://www.suse.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion