Link following in rpm-software-management rpm

1) Link following

EUVDB-ID: #VU31396

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-7501

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Exploit availability: No

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.

Mitigation

Install update from vendor's website.

Vulnerable software versions

rpm: 4.13.0.1 - 4.13.0.2

CPE2.3

• cpe:2.3::rpm:rpm:4.13.0.1:*:*:*:*:*:*:*
• cpe:2.3::rpm:rpm:4.13.0.2:*:*:*:*:*:*:*

External links

https://github.com/rpm-software-management/rpm/commit/404ef011c300207cdb1e531670384564aae04bdc
https://security.gentoo.org/glsa/201811-22

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.