CVE-2019-3687 "easy" permission profile allows everyone execute dumpcap and read all network traffic

Medium 4.0 Published 24 Jan 2020 Updated 16 Sep 2024

Local users can sniff network traffic if the 'easy' permission profile is enabled, allowing unauthorized data access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2019-3687?

CVE-2019-3687 is a medium-severity missing authorization vulnerability in Suse Linux Enterprise Server, published on 24 Jan 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to 081d081dcfaf61710bda34bc21c80c66276119aa.

Weakness: CWE-276

Which versions are affected by CVE-2019-3687?

It affects 1 product.

Products include Suse Linux Enterprise Server.

How do I fix CVE-2019-3687?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-3687 being exploited?

There is no known exploitation of CVE-2019-3687 in the wild and no public exploit code.

All Suse Linux Enterprise Server vulnerabilities

Sources

Also known as GHSA-q4cf-vq5x-23pq.