Symlink attack in Red Hat Gluster Storage Server for On-premise - CVE-2018-1088

Vulnerability identifier: #VU12150

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1088

CWE-ID: CWE-61

Exploitation vector: Adjecent network

Exploit availability: Public exploit is available

The vulnerability allows an adjacent unauthenticated attacker to gain elevated privileges on the target system.

The weakness exists in the snapshot scheduler due to improper security restrictions during the mounting of gluster volumes. An adjacent attacker can access a gluster node, perform symbolic link attack that is designed to schedule malicious cronjobs and gain root privileges.

Red Hat Gluster Storage Server for On-premise
Red Hat Virtualization
Red Hat Virtualization Host
Red Hat Enterprise Linux Server
Fedora
glusterfs (Red Hat package)
glusterfs

Install update from vendor's website.

glusterfs (Red Hat package) - addressed in versions 3.8.4-54.6.el7, 3.8.4-54.6.el7rhgs, 3.8.4-54.7.el6, 3.8.4-54.7.el6rhs
glusterfs - addressed in versions 3.10.12-1.fc26, 3.12.9-1.fc27, 4.0.2-1.fc28

• Exploit #1966 - GEVAUDAN (Exploit for Red Hat / GlusterFS CVE-2018-1088 & CVE-2018-1112, featured @ DEFCON 26, Las Vegas!) (March 18, 2020)

• https://access.redhat.com/security/cve/cve-2018-1088

• Symlink attack in Red Hat Gluster Storage Server
• Red Hat update for ISC DHCP
• Red Hat update for glusterfs
• Red Hat update for glusterfs
• Native Client for Red Hat Enterprise Linux 7 for Red Hat Storage and Red Hat Gluster Storage 3.3 for Red Hat Enterprise Linux 7 update for glusterfs
• Native Client for Red Hat Enterprise Linux 6 for Red Hat Storage and Red Hat Gluster Storage 3.3 for Red Hat Enterprise Linux 6 update for glusterfs
• Fedora 28 update for glusterfs
• Fedora 27 update for glusterfs
• Fedora 26 update for glusterfs