CVE-2020-8013

A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.

A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.

A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.

A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.

This update for permissions fixes the following issues:

Security issues fixed:

• CVE-2019-3687: Fixed a privilege escalation which could allow a local user to read network traffic if wireshark is installed (bsc#1148788)
• CVE-2020-8013: Fixed an issue where chkstat set unintended setuid/capabilities for mrsh and wodim (bsc#1163922).

Non-security issues fixed:

• Fixed a regression where chkstat breaks without /proc available (bsc#1160764, bsc#1160594).
• Fixed capability handling when doing multiple permission changes at once (bsc#1161779).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for permissions fixes the following issues:

Update to version 20200127:

• Makefile: Leap 15.3 still uses /etc, so adjust the installation setup

Update to version 20181225:

• mgetty: faxq-helper now finally reside in /usr/libexec
• libksysguard5: Updated path for ksgrd_network_helper
• kdesu: Updated path for kdesud
• sbin_dirs cleanup: these binaries have already been moved to /usr/sbin
• mariadb: revert auth_pam_tool to /usr/lib{,64} again
• cleanup: revert virtualbox back to plain /usr/lib
• cleanup: remove deprecated /etc/ssh/sshd_config
• hawk_invoke is not part of newer hawk2 packages anymore
• cleanup: texlive-filesystem: public now resides in libexec
• cleanup: authbind: helper now resides in libexec
• cleanup: polkit: the agent now also resides in libexec
• libexec cleanup: 'inn' news binaries now reside in libexec
• whitelist please (boo#1183669)
• Fix enlightenment paths
• usbauth: drop compatibility variable for libexec
• usbauth: Updated path for usbauth-npriv
• profiles: finish usage of variable for polkit-agent-helper-1
• Makefile: fix custom flags support when using make command line variables
• added information about know limitations of this approach
• Makefile: compile with LFO support to fix 32-bit emulation on 64-bit hosts (boo#1178476)
• Makefile: support CXXFLAGS and LDFLAGS override / extension via make/env variables (boo#1178475)
• profiles: prepare /usr/sbin versions of profile entries (boo#1029961)
• profiles: use new variables feature to remove redundant entries
• profiles: remove now superfluous squid pinger paths (boo#1171569)
• tests: implement basic tests for new the new variable feature
• tests: avoid redundant specification of test names by using class names
• regtests: split up base types and actual test implementation
• man pages: add documentation about variables, update copyrights
• chkstat: implement support for variables in profile paths
• chkstat: prepare reuse of config file locations
• chkstat: fix some typos and whitespace
• etc/permissions: remove unnecessary, duplicate, outdated entries
• etc/permissions: remove trailing whitespace
• ksgrd_network_helper: remove obviously wrong path
• adjust squid pinger path (boo#1171569)
• mgetty: remove long dead (or never existing) locks directory (boo#1171882)
• squid: remove basic_pam_auth which doesn't need special perms (boo#1171569)
• cleanup now useless /usr/lib entries after move to /usr/libexec (boo#1171164)
• drop (f)ping capabilities in favor of ICMP_PROTO sockets (boo#1174504)
• whitelist Xorg setuid-root wrapper (boo#1175867)
• screen: remove /run/uscreens covered by systemd-tmpfiles (boo#1171879)
• Add /usr/libexec for cockpit-session as new path
• physlock: whitelist with tight restrictions (boo#1175720)
• mtr-packet: stop requiring dialout group
• etc/permissions: fix mtr permission
• list_permissions: improve output format
• list_permissions: support globbing in --path argument
• list_permissions: implement simplifications suggested in PR#92
• list_permissions: new tool for better path configuration overview
• regtest: support new getcap output format in libcap-2.42
• regtest: print individual test case errors to stderr
• etc/permissions: remove static /var/spool/* dirs
• etc/permissions: remove outdated entries
• etc/permissions: remove unnecessary static dirs and devices
• screen: remove now unused /var/run/uscreens
• Revert 'etc/permissions: remove entries for bind-chrootenv'
• rework permissions.local text (boo#1173221)
• dbus-1: adjust to new libexec dir location (boo#1171164)
• permission profiles: reinstate kdesud for kde5
• etc/permissions: remove entries for bind-chrootenv
• etc/permissions: remove traceroute entry
• VirtualBox: remove outdated entry which is only a symlink any more
• /bin/su: remove path refering to symlink
• etc/permissions: remove legacy RPM directory entries
• /etc/permissions: remove outdated sudo directories
• singularity: remove outdated setuid-binary entries
• chromium: remove…