Permissions, Privileges, and Access Controls in Keepalived - CVE-2018-19045
Published: November 10, 2018
Vulnerability identifier: #VU15790
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-19045
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to software sets insecure default permissions (0666) when creating new temporary files upon a call to PrintData or PrintStats. A local user can read potentially sensitive information from temporary files.
Affected software
Keepalived
Gentoo Linux
Opensuse
Fedora
keepalived (Alpine package)
keepalived
Gentoo Linux
Opensuse
Fedora
keepalived (Alpine package)
keepalived
How to mitigate CVE-2018-19045
Install updates from vendor's website.
Keepalived - update to 2.0.9
keepalived (Alpine package) - update to 2.0.11-r0
keepalived - update to 2.0.10-1.fc29
keepalived (Alpine package) - update to 2.0.11-r0
keepalived - update to 2.0.10-1.fc29