Insecure Permissions in GNU Guix Leads to User Account Access
CVE-2019-18192

7.8HIGH

Key Information:

Vendor

Gnu
Status
Guix
Vendor
CVE Published:
17 October 2019

What is CVE-2019-18192?

The vulnerability in GNU Guix 1.0.1 arises from incorrect permissions set on the parent directory of user-profile directories, allowing local users to gain unauthorized access to other users' accounts. This flaw reflects a similar issue highlighted in a prior vulnerability. To mitigate the risk, it's essential for administrators to review and adjust directory permissions to ensure they are not world writable.

References

https://issues.guix.gnu.org/issue/37744
x_refsource_MISC
http://www.openwall.com/lists/oss-security/2019/10/17/3
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.