CVE-2019-3687

The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to 081d081dcfaf61710bda34bc21c80c66276119aa.

The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to 081d081dcfaf61710bda34bc21c80c66276119aa.

The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to 081d081dcfaf61710bda34bc21c80c66276119aa.

The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f8602d3163786d57344439 to 081d081dcfaf61710bda34bc21c80c66276119aa.

This update for permissions fixes the following issues:

Security issues fixed:

• CVE-2019-3687: Fixed a privilege escalation which could allow a local user to read network traffic if wireshark is installed (bsc#1148788)
• CVE-2020-8013: Fixed an issue where chkstat set unintended setuid/capabilities for mrsh and wodim (bsc#1163922).

Non-security issues fixed:

• Fixed a regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594).
• Fixed capability handling when doing multiple permission changes at once (bsc#1161779).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for permissions fixes the following issues:

Update to version 20200127:

• Makefile: Leap 15.3 still uses /etc, so adjust the installation setup

Update to version 20181225:

• mgetty: faxq-helper now finally reside in /usr/libexec
• libksysguard5: Updated path for ksgrd_network_helper
• kdesu: Updated path for kdesud
• sbin_dirs cleanup: these binaries have already been moved to /usr/sbin
• mariadb: revert auth_pam_tool to /usr/lib{,64} again
• cleanup: revert virtualbox back to plain /usr/lib
• cleanup: remove deprecated /etc/ssh/sshd_config
• hawk_invoke is not part of newer hawk2 packages anymore
• cleanup: texlive-filesystem: public now resides in libexec
• cleanup: authbind: helper now resides in libexec
• cleanup: polkit: the agent now also resides in libexec
• libexec cleanup: 'inn' news binaries now reside in libexec
• whitelist please (boo#1183669)
• Fix enlightenment paths
• usbauth: drop compatibility variable for libexec
• usbauth: Updated path for usbauth-npriv
• profiles: finish usage of variable for polkit-agent-helper-1
• Makefile: fix custom flags support when using make command line variables
• added information about know limitations of this approach
• Makefile: compile with LFO support to fix 32-bit emulation on 64-bit hosts (boo#1178476)
• Makefile: support CXXFLAGS and LDFLAGS override / extension via make/env variables (boo#1178475)
• profiles: prepare /usr/sbin versions of profile entries (boo#1029961)
• profiles: use new variables feature to remove redundant entries
• profiles: remove now superfluous squid pinger paths (boo#1171569)
• tests: implement basic tests for new the new variable feature
• tests: avoid redundant specification of test names by using class names
• regtests: split up base types and actual test implementation
• man pages: add documentation about variables, update copyrights
• chkstat: implement support for variables in profile paths
• chkstat: prepare reuse of config file locations
• chkstat: fix some typos and whitespace
• etc/permissions: remove unnecessary, duplicate, outdated entries
• etc/permissions: remove trailing whitespace
• ksgrd_network_helper: remove obviously wrong path
• adjust squid pinger path (boo#1171569)
• mgetty: remove long dead (or never existing) locks directory (boo#1171882)
• squid: remove basic_pam_auth which doesn't need special perms (boo#1171569)
• cleanup now useless /usr/lib entries after move to /usr/libexec (boo#1171164)
• drop (f)ping capabilities in favor of ICMP_PROTO sockets (boo#1174504)
• whitelist Xorg setuid-root wrapper (boo#1175867)
• screen: remove /run/uscreens covered by systemd-tmpfiles (boo#1171879)
• Add /usr/libexec for cockpit-session as new path
• physlock: whitelist with tight restrictions (boo#1175720)
• mtr-packet: stop requiring dialout group
• etc/permissions: fix mtr permission
• list_permissions: improve output format
• list_permissions: support globbing in --path argument
• list_permissions: implement simplifications suggested in PR#92
• list_permissions: new tool for better path configuration overview
• regtest: support new getcap output format in libcap-2.42
• regtest: print individual test case errors to stderr
• etc/permissions: remove static /var/spool/* dirs
• etc/permissions: remove outdated entries
• etc/permissions: remove unnecessary static dirs and devices
• screen: remove now unused /var/run/uscreens
• Revert 'etc/permissions: remove entries for bind-chrootenv'
• rework permissions.local text (boo#1173221)
• dbus-1: adjust to new libexec dir location (boo#1171164)
• permission profiles: reinstate kdesud for kde5
• etc/permissions: remove entries for bind-chrootenv
• etc/permissions: remove traceroute entry
• VirtualBox: remove outdated entry which is only a symlink any more
• /bin/su: remove path refering to symlink
• etc/permissions: remove legacy RPM directory entries
• /etc/permissions: remove outdated sudo directories
• singularity: remove outdated setuid-binary entries
• chromium: remove…

These are all security issues fixed in the chkstat-1550_20210901-29.2 package on the GA media of openSUSE Tumbleweed.

This update for permissions fixes the following issues:

Security issues fixed:

• CVE-2019-3687: Fixed a privilege escalation which could allow a local user to read network traffic if wireshark is installed (bsc#1148788)
• CVE-2020-8013: Fixed an issue where chkstat set unintended setuid/capabilities for mrsh and wodim (bsc#1163922).

Non-security issues fixed:

• Fixed a regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594).
• Fixed capability handling when doing multiple permission changes at once (bsc#1161779).