CVE-2017-9270 post-auth arbitrary file write on cryptctl server
A malicious server can send RPC requests to overwrite files outside the key database, allowing arbitrary file modification.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-9270?
CVE-2017-9270 is a high-severity path traversal vulnerability in SUSE cryptctl, published on 1 Mar 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In cryptctl before version 2.0 a malicious server could send RPC requests that could overwrite files outside of the cryptctl key database.
Which versions are affected by CVE-2017-9270?
It affects 1 product.
Linux distribution packages (1)
cryptctl SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 1.2.6-5.3.11 |
Products include Opensuse Cryptctl.
How do I fix CVE-2017-9270?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2017-9270 being exploited?
There is no known exploitation of CVE-2017-9270 in the wild and no public exploit code.
Other vulnerabilities in SUSE cryptctl
Sources
Also known as GHSA-whc2-8cpp-f5cp, SUSE-SU-2017:1865-1.