CVE-2019-18932
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations.
El archivo log.c en Squid Analysis Report Generator (sarg) versiones hasta 2.3.11, permite una escalada de privilegios locales. Por defecto, utiliza un directorio temporal fijo /tmp/sarg. Como el usuario root, sarg crea este directorio o reutiliza uno existente de manera no segura. Un atacante puede crear previamente el directorio y colocar enlaces simbólicos en él (después de ganar una condición de carrera de /tmp/sarg/denied.int_unsort). El resultado será archivos corruptos o recién creados en ubicaciones privilegiadas del sistema de archivos.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-11-13 CVE Reserved
- 2020-01-21 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-59: Improper Link Resolution Before File Access ('Link Following')
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2020/01/20/6 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2020/01/27/1 | Mailing List |
|
| https://bugzilla.suse.com/show_bug.cgi?id=1150554 | Issue Tracking | |
| https://seclists.org/oss-sec/2020/q1/23 | Mailing List |
|
| https://sourceforge.net/projects/sarg | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00051.html | 2022-04-26 | |
| http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00063.html | 2022-04-26 | |
| https://security.gentoo.org/glsa/202007-32 | 2022-04-26 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Squid Analysis Report Generator Project Search vendor "Squid Analysis Report Generator Project" | Squid Analysis Report Generator Search vendor "Squid Analysis Report Generator Project" for product "Squid Analysis Report Generator" | <= 2.3.11 Search vendor "Squid Analysis Report Generator Project" for product "Squid Analysis Report Generator" and version " <= 2.3.11" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Backports Sle Search vendor "Opensuse" for product "Backports Sle" | 15.0 Search vendor "Opensuse" for product "Backports Sle" and version "15.0" | sp1 |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 15.1 Search vendor "Opensuse" for product "Leap" and version "15.1" | - |
Affected
| ||||||