Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:40882
HistoryJun 13, 2023 - 4:22 p.m.

File Permission Bypass

2023-06-1316:22:05
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
13
file permission bypass
libarchive.so
race condition
vulnerability
file deletion
file renaming
software

CVSS3

5.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

EPSS

0

Percentile

5.1%

libarchive.so is vulnerable to File Permission Bypass. The vulnerability exists due to a race condition in _archive_write_disk_header function at archive_write_disk_posix.c because the unmasking process does not take intro consideration other threads working on the same file, which allows an attacker to delete and rename files inside the directories.

CVSS3

5.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

EPSS

0

Percentile

5.1%