Lucene search

K
redosRedosROS-20230825-03
HistoryAug 25, 2023 - 12:00 a.m.

ROS-20230825-03

2023-08-2500:00:00
redos.red-soft.ru
13
libarchive
umask() call
hidden directory
permissions
file deletion
renaming

CVSS3

5.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

EPSS

0

Percentile

5.1%

A vulnerability in the Libarchive library is related to the umask() call inside archive_write_disk_posix.c, which
changes the umask of the entire process for a very short period of time, this results in a permanent setting of
umask 0, which will cause the hidden creation of a directory with permissions 0777 (no fixed bit).
Exploitation of the vulnerability could allow an attacker to delete and rename files within these
directories.

OSVersionArchitecturePackageVersionFilename
redos7.3x86_64libarchive< 3.6.2-1UNKNOWN

CVSS3

5.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

EPSS

0

Percentile

5.1%