CVE-2020-24332

2020-08-1300:00:00

ubuntu.com

CVSS2

4.9

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

24.1%

JSON

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is
started with root privileges, the creation of the system.data file is prone
to symlink attacks. The tss user can be used to create or corrupt existing
files, which could possibly lead to a DoS attack.

Bugs

<https://bugzilla.suse.com/show_bug.cgi?id=1164472>

Notes

Author	Note
mdeslaur	the Debian/Ubuntu package starts tcsd as the tss user, not as root, so this issue doesn’t affect default configurations

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchtrousers< anyUNKNOWN
ubuntu20.04noarchtrousers< anyUNKNOWN
ubuntu16.04noarchtrousers< anyUNKNOWN