CVE-2020-8025

07.08.2020, 10:15

A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.1 MEDIUM	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 15%

Ubuntu Releases

Ubuntu Product

Codename

pcp

bionic	not-affected
focal	not-affected
trusty	dne
xenial	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

libpcp-devel

suse enterprise server 15

3.11.9-5.11.5

fixed

libpcp3

suse enterprise server 15

3.11.9-5.11.5

fixed

libpcp_gui2

suse enterprise server 15

3.11.9-5.11.5

fixed

libpcp_import1

suse enterprise server 15

3.11.9-5.11.5

fixed

libpcp_mmv1

suse enterprise server 15

3.11.9-5.11.5

fixed

libpcp_trace2

suse enterprise server 15

3.11.9-5.11.5

fixed

libpcp_web1

suse enterprise server 15

3.11.9-5.11.5

fixed

pcp

suse enterprise server 15

3.11.9-5.11.5

fixed

pcp-conf

suse enterprise server 15

3.11.9-5.11.5

fixed

pcp-devel

suse enterprise server 15

3.11.9-5.11.5

fixed

pcp-doc

suse enterprise server 15

3.11.9-5.11.5

fixed

pcp-import-iostat2pcp

suse enterprise server 15

3.11.9-5.11.5

fixed

pcp-import-mrtg2pcp

suse enterprise server 15

3.11.9-5.11.5

fixed

pcp-import-sar2pcp

suse enterprise server 15

3.11.9-5.11.5

fixed

perl-PCP-LogImport

suse enterprise server 15

3.11.9-5.11.5

fixed

perl-PCP-LogSummary

suse enterprise server 15

3.11.9-5.11.5

fixed

perl-PCP-MMV

suse enterprise server 15

3.11.9-5.11.5

fixed

perl-PCP-PMDA

suse enterprise server 15

3.11.9-5.11.5

fixed

permissions-20181224

suse enterprise desktop 15 SP2	23.3.1 fixed
suse enterprise desktop 15 SP3	23.3.1 fixed
suse enterprise sap 15 SP2	23.3.1 fixed
suse enterprise sap 15 SP3	23.3.1 fixed
suse enterprise server 15 SP2	23.3.1 fixed
suse enterprise server 15 SP3	23.3.1 fixed

permissions-20201225

suse enterprise desktop 15 SP4	150400.3.4 fixed
suse enterprise desktop 15 SP5	150400.5.16.1 fixed
suse enterprise desktop 15 SP6	150400.5.16.1 fixed
suse enterprise sap 15 SP4	150400.3.4 fixed
suse enterprise sap 15 SP5	150400.5.16.1 fixed
suse enterprise sap 15 SP6	150400.5.16.1 fixed
suse enterprise server 15 SP4	150400.3.4 fixed
suse enterprise server 15 SP5	150400.5.16.1 fixed
suse enterprise server 15 SP6	150400.5.16.1 fixed

permissions-20240826

suse enterprise desktop 15 SP7	150700.14.4 fixed
suse enterprise sap 15 SP7	150700.14.4 fixed
suse enterprise server 15 SP7	150700.14.4 fixed

permissions-zypp-plugin-20181224

suse enterprise desktop 15 SP2	23.3.1 fixed
suse enterprise desktop 15 SP3	23.3.1 fixed
suse enterprise sap 15 SP2	23.3.1 fixed
suse enterprise sap 15 SP3	23.3.1 fixed
suse enterprise server 15 SP2	23.3.1 fixed
suse enterprise server 15 SP3	23.3.1 fixed

permissions-zypp-plugin-20201225

suse enterprise desktop 15 SP4	150400.3.4 fixed
suse enterprise desktop 15 SP5	150400.5.16.1 fixed
suse enterprise desktop 15 SP6	150400.5.16.1 fixed
suse enterprise sap 15 SP4	150400.3.4 fixed
suse enterprise sap 15 SP5	150400.5.16.1 fixed
suse enterprise sap 15 SP6	150400.5.16.1 fixed
suse enterprise server 15 SP4	150400.3.4 fixed
suse enterprise server 15 SP5	150400.5.16.1 fixed
suse enterprise server 15 SP6	150400.5.16.1 fixed

permissions-zypp-plugin-20240826

suse enterprise desktop 15 SP7	150700.14.4 fixed
suse enterprise sap 15 SP7	150700.14.4 fixed
suse enterprise server 15 SP7	150700.14.4 fixed

python-pcp

suse enterprise server 15

3.11.9-5.11.5

fixed

Known Exploits!

Common Weakness Enumeration

CWE-279 - Incorrect Execution-Assigned Permissions
While it is executing, the software sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.

References

https://bugzilla.suse.com/show_bug.cgi?id=1171883