Lucene search

GoogleOSV:CVE-2023-23558

HistoryFeb 16, 2023 - 4:15 p.m.

CVE-2023-23558

2023-02-1616:15:12

Google

osv.dev

eternal terminal

telemetryservice

fixed paths

/tmp

local attacker

sensitive information

modification

vulnerability

software

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

Low

EPSS

Percentile

5.1%

JSON

In Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp. For example, a local attacker can create /tmp/.sentry-native-etserver with mode 0777 before the etserver process is started. The attacker can choose to read sensitive information from that file, or modify the information in that file.

References

www.openwall.com/lists/oss-security/2023/02/16/1

bugzilla.suse.com/show_bug.cgi?id=1207126

github.com/MisterTea/EternalTerminal

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

Low

EPSS

Percentile

5.1%

JSON

Related for OSV:CVE-2023-23558