supportutils

5 results · Feed

• Medium 6.7
  CVE-2018-19639

  Code execution if run with command line switch -v

  If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipulate the rpm listing (e.g. with CVE-2018-19638) he can execute arbitrary commands as root.

  SUSE supportutils
  Mar 5, 2019
• Medium 4.4
  CVE-2018-19640

  Code execution if run with command line switch -v

  If the attacker manages to create files in the directory used to collect log files in supportutils before version 3.1-5.7.1 (e.g. with CVE-2018-19638) he can kill arbitrary processes on the local machine.

  SUSE supportutils
  Mar 5, 2019
• Low 2.2
  CVE-2018-19638

  User can overwrite arbitrary log files in support tar

  In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files.

  SUSE supportutils
  Mar 5, 2019
• High 7.3
  CVE-2018-19636

  Local root exploit via inclusion of attacker controlled shell script

  Supportutils, before version 3.1-5.7.1, when run with command line argument -A searched the file system for a ndspath binary. If an attacker provides one at an arbitrary location it is executed with root privileges

  SUSE supportutils
  Mar 5, 2019
• Low 2.8
  CVE-2018-19637

  Static temporary filename allows overwriting of files

  Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection

  SUSE supportutils
  Mar 5, 2019