Incorrect default permissions in SEL AcSELerator Architect and SEL Compass - CVE-2018-10604

Vulnerability identifier: #VU13800

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10604

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to incorrect default permissions. A local attacker can gain full access to the SEL Compass directory, modifiy or overwrite files within the Compass installation folder, and gain execute arbitrary code with elevated privileges.

SEL AcSELerator Architect
SEL Compass
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Opensuse

SEL AcSELerator Architect - update to 2.2.28.0
SEL Compass - update to 5.0.6.0

• https://ics-cert.us-cert.gov/advisories/ICSA-18-191-02

• Multiple vulnerabilities in Schweitzer Engineering Compass and AcSELerator Architector
• OpenSUSE Linux update for python3
• Red Hat update for python