CVE-2020-8024 Problematic permissions in hylafax+ packaging allow escalation from uucp to other users
Local attackers can escalate privileges from the uucp user to other users due to incorrect default permissions in the hylafax+ package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-8024?
CVE-2020-8024 is a medium-severity vulnerability in openSUSE Factory, published on 29 Jun 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers to escalate from user uucp to users calling hylafax binaries. This issue affects: openSUSE Leap 15.2 hylafax+ versions prior to 7.0.2-lp152.2.1. openSUSE Leap 15.1 hylafax+ version 5.6.1-lp151.3.7 and prior versions. openSUSE Factory hylafax+ versions prior to 7.0.2-2.1.
Weakness: CWE-276
Which versions are affected by CVE-2020-8024?
It affects 1 product.
Linux distribution packages (1)
hylafax+ openSUSE:Leap 15.1 | All versions | 7.0.2-lp151.4.3.1 |
Products include Opensuse Hylafax\+.
How do I fix CVE-2020-8024?
Upgrade to a fixed version.
Is CVE-2020-8024 being exploited?
There is no known exploitation of CVE-2020-8024 in the wild and no public exploit code.
Sources
Also known as GHSA-rv88-x9wr-52g7, UBUNTU-CVE-2020-8024, openSUSE-SU-2020:0958-1.