Local Privilege Escalation in SUSE openSUSE Factory Cobbler Service

CVE-2011-1551

Summary

The SUSE openSUSE Factory Cobbler service poses a local privilege escalation vulnerability due to improper ownership assignments of the /var/log/cobbler/ directory. The directory is incorrectly owned by the web-service user account, enabling local users to exploit this misconfiguration. By leveraging access to the web-service user during root filesystem operations, an attacker could gain elevated privileges, potentially allowing unauthorized actions on the system. It is critical for system administrators to recognize this vulnerability and apply appropriate mitigations to protect against unauthorized access.

References