UNIX symbolic link following in libqb - CVE-2019-12779

Vulnerability identifier: #VU19263

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-12779

CWE-ID: CWE-61

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a symlink following issue because software uses predictable filenames (under /dev/shm and /tmp) without O_EXCL in libqb before 1.0.5. A local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application.

Successful exploitation of this vulnerability may result in privilege escalation.

libqb
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Opensuse
SUSE Linux
openEuler
libqb (Red Hat package)
libqb
libqb-debuginfo
libqb-debugsource
libqb-devel
libqb-help

Install update from vendor's website.

libqb - update to 1.0.5
libqb (Red Hat package) - update to 1.0.1-9.el7
libqb - update to 1.0.3-7
libqb-debuginfo - update to 1.0.3-7
libqb-debugsource - update to 1.0.3-7
libqb-devel - update to 1.0.3-7
libqb-help - update to 1.0.3-7

• https://bugzilla.redhat.com/show_bug.cgi?id=1695948
• https://github.com/ClusterLabs/libqb/issues/338
• https://github.com/ClusterLabs/libqb/releases/tag/v1.0.4
• https://github.com/ClusterLabs/libqb/releases/tag/v1.0.5

• OpenSUSE Linux update for libqb
• Privilege escalation in libqb
• OpenSUSE Linux update for libqb
• OpenSUSE Linux update for libqb
• Red Hat update for libqb
• Red Hat Enterprise Linux 7 update for libqb
• Gentoo update for libqb
• openEuler 20.03 LTS SP1 update for libqb