Vulnerability Name:

CVE-2019-3692 (CCN-175087)

Assigned:2019-01-03
Published:2019-01-03
Updated:2022-11-16
Summary:The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to escalate from user inn to root via symlink attacks. This issue affects: SUSE Linux Enterprise Server 11 inn version 2.4.2-170.21.3.1 and prior versions. openSUSE Factory inn version 2.6.2-2.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.2.47 and prior versions.
CVSS v3 Severity:7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.7 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
7.1 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:U/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-59
Vulnerability Consequences:File Manipulation
References:Source: MITRE
Type: CNA
CVE-2019-3692

Source: SUSE
Type: Broken Link, Mailing List, Third Party Advisory
openSUSE-SU-2020:0234

Source: SUSE
Type: Broken Link, Mailing List, Third Party Advisory
openSUSE-SU-2020:0242

Source: CCN
Type: Bugzilla – Bug 1154302
(CVE-2019-3692) VUL-0: CVE-2019-3692: inn: LPE from news to root

Source: CONFIRM
Type: Exploit, Issue Tracking, Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1154302

Source: XF
Type: UNKNOWN
leap-cve20193692-symlink(175087)

Source: CCN
Type: openSUSE Web site
Leap

Vulnerable Configuration:Configuration 1:
  • cpe:/a:suse:inn:*:*:*:*:*:*:*:* (Version <= 2.4.2-170.21.3.1)
  • AND
  • cpe:/o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:suse:inn:*:*:*:*:*:*:*:* (Version <= 2.6.2-2.2)
  • AND
  • cpe:/a:opensuse:factory:-:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:suse:inn:*:*:*:*:*:*:*:* (Version <= 2.5.4-lp151.2.47)
  • AND
  • cpe:/o:opensuse:leap:15.1:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:opensuse:leap:15.1:*:*:*:*:*:*:*
  • OR cpe:/a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:opensuse:leap:15.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20193692
    V
    		CVE-2019-3692
    2022-06-30
    oval:org.opensuse.security:def:112436
    P
    		inn-2.6.3-4.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:33111
    P
    		Security update for the Linux Kernel (Important) (in QA)
    2022-01-17
    oval:org.opensuse.security:def:30159
    P
    		Security update for mozilla-nss (Important)
    2021-12-06
    oval:org.opensuse.security:def:33745
    P
    		Security update for java-1_7_0-openjdk (Important)
    2021-11-24
    oval:org.opensuse.security:def:30266
    P
    		Security update for samba (Important)
    2021-11-16
    oval:org.opensuse.security:def:33023
    P
    		Security update for MozillaFirefox (Important)
    2021-10-15
    oval:org.opensuse.security:def:33987
    P
    		Security update for MozillaFirefox (Important)
    2021-10-15
    oval:org.opensuse.security:def:105942
    P
    		inn-2.6.3-4.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:74733
    P
    		Security update for the Linux Kernel (Important)
    2021-09-23
    oval:org.opensuse.security:def:63234
    P
    		rmt-server-1.2.2-1.15 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:30247
    P
    		Security update for openssl (Low)
    2021-09-20
    oval:org.opensuse.security:def:63437
    P
    		libsndfile1-32bit-1.0.28-5.5.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:62738
    P
    		eog-3.34.2-1.46 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62731
    P
    		accountsservice-0.6.55-3.14 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62763
    P
    		libICE6-32bit-1.0.9-1.25 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62735
    P
    		conky-1.11.5-1.20 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:30104
    P
    		Security update for systemd (Important)
    2021-07-21
    oval:org.opensuse.security:def:32966
    P
    		Security update for curl (Moderate)
    2021-07-21
    oval:org.opensuse.security:def:64546
    P
    		Security update for systemd (Moderate)
    2021-07-20
    oval:org.opensuse.security:def:93571
    P
    		 (Moderate)
    2021-06-29
    oval:org.opensuse.security:def:30208
    P
    		Security update for spice (Important)
    2021-06-08
    oval:org.opensuse.security:def:100284
    P
    		 (Important)
    2021-06-01
    oval:org.opensuse.security:def:64488
    P
    		Security update for ceph (Important)
    2021-05-04
    oval:org.opensuse.security:def:33898
    P
    		Security update for gdm (Important)
    2021-04-28
    oval:org.opensuse.security:def:64658
    P
    		Security update for python-Jinja2 (Important)
    2021-02-26
    oval:org.opensuse.security:def:33072
    P
    		Security update for openvswitch (Important)
    2021-02-12
    oval:org.opensuse.security:def:28926
    P
    		Security update for python3 (Important)
    2021-02-08
    oval:org.opensuse.security:def:64279
    P
    		Security update for webkit2gtk3 (Important)
    2020-12-17
    oval:org.opensuse.security:def:64278
    P
    		Security update for clamav (Moderate)
    2020-12-14
    oval:org.opensuse.security:def:29951
    P
    		Security update for the Linux Kernel (Live Patch 34 for SLE 12 SP2) (Important)
    2020-12-07
    oval:org.opensuse.security:def:63584
    P
    		libgadu-devel-1.12.2-1.44 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:62941
    P
    		checkbashisms-2.15.1-1.49 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:33609
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:64386
    P
    		libspice-client-glib-2_0-8 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29516
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34144
    P
    		Security update for openldap2
    2020-12-01
    oval:org.opensuse.security:def:33178
    P
    		librsvg on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29085
    P
    		Security update for emacs (Important)
    2020-12-01
    oval:org.opensuse.security:def:32572
    P
    		libvorbis on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34251
    P
    		Security update for postgresql10 (Important)
    2020-12-01
    oval:org.opensuse.security:def:28417
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:35037
    P
    		Security update for inn (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33515
    P
    		Security update for PostgreSQL
    2020-12-01
    oval:org.opensuse.security:def:30948
    P
    		Recommended update for glibc (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32347
    P
    		Security update for sqlite3 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29808
    P
    		Security update for jakarta-commons-fileupload
    2020-12-01
    oval:org.opensuse.security:def:29029
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:32359
    P
    		Security update for strongswan (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29803
    P
    		Security update for inn (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28338
    P
    		Security update for php53 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32810
    P
    		xorg-x11-libs-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34359
    P
    		Security update for taglib
    2020-12-01
    oval:org.opensuse.security:def:28690
    P
    		Security update for foomatic-filters (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29589
    P
    		Security update for apache2-mod_python
    2020-12-01
    oval:org.opensuse.security:def:34202
    P
    		Security update for perl-Archive-Zip (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33816
    P
    		Security update for glib2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:33514
    P
    		Security update for perl-IO-Socket-SSL
    2020-12-01
    oval:org.opensuse.security:def:63813
    P
    		Security update for libunwind (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29129
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:32666
    P
    		ft2demos on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34290
    P
    		Security update for python-numpy (Important)
    2020-12-01
    oval:org.opensuse.security:def:28548
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:33526
    P
    		Security update for w3m
    2020-12-01
    oval:org.opensuse.security:def:28980
    P
    		Security update for tidy (Low)
    2020-12-01
    oval:org.opensuse.security:def:30985
    P
    		Security update for inn (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29505
    P
    		Security update for ImageMagick (Important)
    2020-12-01
    oval:org.opensuse.security:def:74600
    P
    		Security update for jasper (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28337
    P
    		Security update for php53 (Important)
    2020-12-01
    oval:org.opensuse.security:def:29865
    P
    		Security update for the Linux Kernel (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33134
    P
    		libFLAC++6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29068
    P
    		Security update for clamav (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32437
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:28349
    P
    		Security update for php53 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34997
    P
    		Security update for glibc (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28774
    P
    		Security update for libvirt
    2020-12-01
    oval:org.opensuse.security:def:30310
    P
    		Security update for tcpdump
    2020-12-01
    oval:org.opensuse.security:def:33841
    P
    		Security update for gtk2
    2020-12-01
    oval:org.opensuse.security:def:29721
    P
    		Security update for MozillaFirefox
    2020-12-01
    oval:org.opensuse.security:def:33855
    P
    		Security update for inn (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32348
    P
    		Security update for sqlite3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:64142
    P
    		Security update for squid (Critical)
    2020-12-01
    oval:org.opensuse.security:def:29767
    P
    		Security update for glibc (Important)
    2020-12-01
    oval:org.opensuse.security:def:29504
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32723
    P
    		libopenssl0_9_8 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34315
    P
    		Security update for ruby (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28633
    P
    		Security update for acroread
    2020-12-01
    oval:org.opensuse.security:def:110391
    P
    		Security update for inn (Moderate)
    2020-02-19
    BACK
    suse inn *
    suse linux enterprise server 11 -
    suse inn *
    opensuse factory -
    suse inn *
    opensuse leap 15.1
    opensuse leap 15.1
    opensuse backports sle 15.0 sp1
    opensuse leap 15.1