Vulnerability Details CVE-2019-3689
The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 40.9%
CVSS Severity
CVSS v3 Score 5.1
CVSS v2 Score 10.0
References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00071.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00006.html
- https://bugzilla.suse.com/show_bug.cgi?id=1150733
- https://git.linux-nfs.org/?p=steved/nfs-utils.git%3Ba=commitdiff%3Bh=fee2cc29e888f2ced6a76990923aef19d326dc0e
- https://lists.debian.org/debian-lts-announce/2019/10/msg00026.html
- https://usn.ubuntu.com/4400-1/
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00071.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00006.html
- https://bugzilla.suse.com/show_bug.cgi?id=1150733
- https://git.linux-nfs.org/?p=steved/nfs-utils.git%3Ba=commitdiff%3Bh=fee2cc29e888f2ced6a76990923aef19d326dc0e
- https://lists.debian.org/debian-lts-announce/2019/10/msg00026.html
- https://usn.ubuntu.com/4400-1/
Products affected by CVE-2019-3689
-
cpe:2.3:a:linux-nfs:nfs-utils:0.1.1
-
cpe:2.3:a:linux-nfs:nfs-utils:0.1.2
-
cpe:2.3:a:linux-nfs:nfs-utils:0.1.3
-
cpe:2.3:a:linux-nfs:nfs-utils:0.1.4
-
cpe:2.3:a:linux-nfs:nfs-utils:0.1.5
-
cpe:2.3:a:linux-nfs:nfs-utils:0.1.6
-
cpe:2.3:a:linux-nfs:nfs-utils:0.1.7
-
cpe:2.3:a:linux-nfs:nfs-utils:0.1.8
-
cpe:2.3:a:linux-nfs:nfs-utils:0.1.8.2
-
cpe:2.3:a:linux-nfs:nfs-utils:0.1.9
-
cpe:2.3:a:linux-nfs:nfs-utils:0.1.9.1
-
cpe:2.3:a:linux-nfs:nfs-utils:0.2
-
cpe:2.3:a:linux-nfs:nfs-utils:0.2.1
-
cpe:2.3:a:linux-nfs:nfs-utils:0.3.1
-
cpe:2.3:a:linux-nfs:nfs-utils:0.3.3
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.1
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.10
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.11
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.12
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.3
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.4
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.5
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.6
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.7
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.7-pre1
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.7-pre2
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.8
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.8-rc1
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.8-rc2
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.8-rc3
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.8-rc4
-
cpe:2.3:a:linux-nfs:nfs-utils:1.0.9
-
cpe:2.3:a:linux-nfs:nfs-utils:1.1.0
-
cpe:2.3:a:linux-nfs:nfs-utils:1.1.0-rc1
-
cpe:2.3:a:linux-nfs:nfs-utils:1.1.1
-
cpe:2.3:a:linux-nfs:nfs-utils:1.1.2
-
cpe:2.3:a:linux-nfs:nfs-utils:1.1.3
-
cpe:2.3:a:linux-nfs:nfs-utils:1.1.4
-
cpe:2.3:a:linux-nfs:nfs-utils:1.1.5
-
cpe:2.3:a:linux-nfs:nfs-utils:1.1.6
-
cpe:2.3:a:linux-nfs:nfs-utils:1.2.0
-
cpe:2.3:a:linux-nfs:nfs-utils:1.2.1
-
cpe:2.3:a:linux-nfs:nfs-utils:1.2.2
-
cpe:2.3:a:linux-nfs:nfs-utils:1.2.3
-
cpe:2.3:a:linux-nfs:nfs-utils:1.2.4
-
cpe:2.3:a:linux-nfs:nfs-utils:1.2.5
-
cpe:2.3:a:linux-nfs:nfs-utils:1.2.6
-
cpe:2.3:a:linux-nfs:nfs-utils:1.2.7
-
cpe:2.3:a:linux-nfs:nfs-utils:1.2.8
-
cpe:2.3:a:linux-nfs:nfs-utils:1.2.9
-
cpe:2.3:a:linux-nfs:nfs-utils:1.3.0
-
cpe:2.3:a:linux-nfs:nfs-utils:1.3.1
-
cpe:2.3:a:linux-nfs:nfs-utils:1.3.2
-
cpe:2.3:a:linux-nfs:nfs-utils:1.3.3
-
cpe:2.3:a:linux-nfs:nfs-utils:1.3.4
-
cpe:2.3:a:linux-nfs:nfs-utils:2.1.1
-
cpe:2.3:o:suse:linux_enterprise_server:12
-
cpe:2.3:o:suse:linux_enterprise_server:15