Описание
A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.
Отчет
Moderate: This flaw in sblim-cmpi-base provider registration scripts allows a local unprivileged attacker to overwrite root-owned files via a symlink attack in world-writable temporary directories. Exploitation requires specific conditions, including a privileged script execution and systems without sticky-directory symlink protections, which reduces its overall impact.
Меры по смягчению последствий
To mitigate this issue, ensure sticky-directory symlink protections are enabled on your system. This can be done immediately by running sysctl -w fs.protected_symlinks=1. To make this change persistent across reboots, create or modify a file in /etc/sysctl.d/ (e.g., /etc/sysctl.d/99-sysctl.conf) with the content fs.protected_symlinks=1 and then run sysctl --system. Additionally, avoid running the sblim-cmpi-base provider registration scripts from shared multi-user systems where untrusted users can create symlinks in /tmp or /var/tmp. If manual execution of the script is necessary, prefer using a private, root-owned temporary directory.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | sblim-cmpi-base | Fix deferred | ||
| Red Hat Enterprise Linux 6 | sblim-cmpi-base | Out of support scope | ||
| Red Hat Enterprise Linux 7 | sblim-cmpi-base | Fix deferred | ||
| Red Hat Enterprise Linux 8 | sblim-cmpi-base | Fix deferred | ||
| Red Hat Enterprise Linux 9 | sblim-cmpi-base | Fix deferred |
Показывать по
Дополнительная информация
Статус:
6.3 Medium
CVSS3
Связанные уязвимости
A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.
A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.
A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.
6.3 Medium
CVSS3