Link following in rpm - CVE-2017-7501
Published: November 22, 2017 / Updated: July 17, 2020
Vulnerability identifier: #VU31396
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-7501
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: rpm-software-management
Affected software:
rpm
rpm
Detailed vulnerability description
The vulnerability allows a local authenticated user to execute arbitrary code.
It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.
How to mitigate CVE-2017-7501
Install update from vendor's website.