CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
5.1%
log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations.
Vendor | Product | Version | CPE |
---|---|---|---|
squid_analysis_report_generator_project | squid_analysis_report_generator | * | cpe:2.3:a:squid_analysis_report_generator_project:squid_analysis_report_generator:*:*:*:*:*:*:*:* |
opensuse | backports_sle | 15.0 | cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* |
opensuse | leap | 15.1 | cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* |
lists.opensuse.org/opensuse-security-announce/2020-01/msg00051.html
lists.opensuse.org/opensuse-security-announce/2020-01/msg00063.html
www.openwall.com/lists/oss-security/2020/01/20/6
www.openwall.com/lists/oss-security/2020/01/27/1
bugzilla.suse.com/show_bug.cgi?id=1150554
seclists.org/oss-sec/2020/q1/23
security.gentoo.org/glsa/202007-32
sourceforge.net/projects/sarg/
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
5.1%