3.3

CVE-2021-25317

cups: ownership of /var/log/cups allows the lp user to create files as root

A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Suse ≫ Cups Version < 1.3.9
   Suse ≫ Linux Enterprise Server Version 11 Update sp4 SwEdition ltss
Fedoraproject ≫ Fedora Version 32
Fedoraproject ≫ Fedora Version 33
Fedoraproject ≫ Fedora Version 34
Suse ≫ Cups Version < 2.2.7
   Suse ≫ Manager Server Version 4.0
Suse ≫ Cups Version < 1.7.5
   Suse ≫ Openstack Cloud Crowbar Version 9.0
Suse ≫ Cups Version < 2.2.7
   Opensuse ≫ Leap Version 15.2
Suse ≫ Cups Version <= 2.3.3op2-2.1
   Opensuse ≫ Factory Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.182
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 3.3 1.8 1.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NIST 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:N/I:P/A:N
SUSE 3.3 1.8 1.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

https://bugzilla.suse.com/show_bug.cgi?id=1184161
Vendor Advisory
Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GWPGZLT3U776Q5YPPSA6LGFWWBDWBVH3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H74BP746O5NNVCBUTLLZYAFBPESFVECV/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S37IDQGHTORQ3Z6VRDQIGBYVOI27YG47/