CVE-2019-3689 nfs-utils: root-owned files stored in insecure /var/lib/nfs directory
A local attacker compromising statd can trick root processes into overwriting arbitrary files due to insecure directory permissions in nfs-utils.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-3689?
CVE-2019-3689 is a medium-severity vulnerability in SUSE Linux Enterprise Server 12, published on 19 Sep 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.
Weakness: CWE-276
Which versions are affected by CVE-2019-3689?
It affects 1 product.
Linux distribution packages (25)
nfs-utils SUSE:Enterprise Storage 4 | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:Enterprise Storage 5 | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:HPE Helion OpenStack 8 | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 2.1.1-6.14.1 |
nfs-utils SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 2.1.1-10.4.1 |
nfs-utils SUSE:Linux Enterprise Server 12 SP1-LTSS | All versions | 1.3.0-41.3.1 |
nfs-utils SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:Linux Enterprise Server 12 SP2-LTSS | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:Linux Enterprise Server 12 SP4 | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 1.3.0-41.3.1 |
nfs-utils SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:OpenStack Cloud 7 | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:OpenStack Cloud 8 | All versions | 1.3.0-34.22.1 |
nfs-utils SUSE:OpenStack Cloud Crowbar 8 | All versions | 1.3.0-34.22.1 |
nfs-utils openSUSE:Leap 15.0 | All versions | 2.1.1-lp150.4.10.1 |
nfs-utils openSUSE:Leap 15.1 | All versions | 2.1.1-lp151.7.3.1 |
nfsidmap openSUSE:Tumbleweed | All versions | 1.0-26.2 |
rpmlint openSUSE:Tumbleweed | All versions | 2.1+git20210924.ad0cf53-1.1 |
Products include Linux-Nfs Nfs-Utils.
How do I fix CVE-2019-3689?
Apply the vendor's patch.
Is CVE-2019-3689 being exploited?
There is no known exploitation of CVE-2019-3689 in the wild and no public exploit code.
Other vulnerabilities in SUSE Linux Enterprise Server 12
Sources
Also known as DEBIAN-CVE-2019-3689, DLA-1965-1, GHSA-qh2q-m44h-cfm8, SUSE-SU-2019:2771-1, SUSE-SU-2019:2776-1, SUSE-SU-2019:2781-1 and 7 more.