CVE-2021-36781 parsec: dangerous 777 permissions for /run/parsec

What is CVE-2021-36781?

CVE-2021-36781 is a medium-severity vulnerability in openSUSE Factory, published on 14 Jan 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients talking to an imposter service. This issue affects: openSUSE Factory parsec versions prior to 0.8.1-1.1.

Weakness: CWE-276

Which versions are affected by CVE-2021-36781?

It affects 1 product.

Products include Opensuse Factory.

How do I fix CVE-2021-36781?

Upgrade to a fixed version.

Is CVE-2021-36781 being exploited?

There is no known exploitation of CVE-2021-36781 in the wild and no public exploit code.

Other vulnerabilities in openSUSE Factory

• CVE-2021-25319 virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group High 7.8
• CVE-2022-31256 sendmail: mail to root privilege escalation via sm-client.pre script High 7.7
• CVE-2022-31251 slurm: %post for slurm-testsuite operates as root in user owned directory Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m398-vv9j-2r7f, openSUSE-SU-2024:11665-1.