Lucene search

K
amazonAmazonALAS-2024-2590
HistoryJul 18, 2024 - 2:00 a.m.

Medium: nano

2024-07-1802:00:00
alas.aws.amazon.com
5
nano
chmod
chown
malicious
symlink
root-owned
cve-2024-5742
update
aarch64
i686
src
x86_64
red hat
mitre
unix

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

5.8

Confidence

High

EPSS

0

Percentile

5.1%

Issue Overview:

nano: running chmod and chown on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file (CVE-2024-5742)

Affected Packages:

nano

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update nano to update your system.

New Packages:

aarch64:  
    nano-2.9.8-2.amzn2.0.2.aarch64  
    nano-debuginfo-2.9.8-2.amzn2.0.2.aarch64  
  
i686:  
    nano-2.9.8-2.amzn2.0.2.i686  
    nano-debuginfo-2.9.8-2.amzn2.0.2.i686  
  
src:  
    nano-2.9.8-2.amzn2.0.2.src  
  
x86_64:  
    nano-2.9.8-2.amzn2.0.2.x86_64  
    nano-debuginfo-2.9.8-2.amzn2.0.2.x86_64  

Additional References

Red Hat: CVE-2024-5742

Mitre: CVE-2024-5742

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

5.8

Confidence

High

EPSS

0

Percentile

5.1%