CVE-2018-16588 : Security Advisory and Response
Learn about CVE-2018-16588, a privilege escalation vulnerability in the SUSE shadow package, allowing local attackers to escalate privileges by manipulating directories created during user creation.
A potential issue of privilege escalation has been identified in the useradd.c code of the SUSE shadow package versions 4.2.1-27.9.1 for SUSE Linux Enterprise 12 (SLE-12) and 4.5-5.39 for SUSE Linux Enterprise 15 (SLE-15). When creating a user, the code unknowingly generates intermediate directories with a permission mode of 0777. This creates a vulnerability as these directories can be modified by any user, enabling local attackers to exploit this weakness for privilege escalation and various other attacks. Users who obtained the useradd.c code from a specific upstream pull request on April 2, 2014, may also be affected.
Understanding CVE-2018-16588
This CVE identifies a privilege escalation vulnerability in the SUSE shadow package's useradd.c code.
What is CVE-2018-16588?
CVE-2018-16588 is a vulnerability in the SUSE shadow package that allows local attackers to escalate privileges by manipulating directories created during user creation.
The Impact of CVE-2018-16588
The vulnerability enables local attackers to exploit world-writable directories for privilege escalation and other malicious activities.
Technical Details of CVE-2018-16588
The technical aspects of the vulnerability are as follows:
Vulnerability Description
The SUSE shadow package versions 4.2.1-27.9.1 for SLE-12 and 4.5-5.39 for SLE-15 create world-writable directories during user creation, leading to privilege escalation.
Affected Systems and Versions
- SUSE Linux Enterprise 12 (SLE-12) versions 4.2.1-27.9.1
- SUSE Linux Enterprise 15 (SLE-15) versions 4.5-5.39
Exploitation Mechanism
Local attackers can exploit the world-writable directories to escalate privileges and conduct various attacks.
Mitigation and Prevention
To address CVE-2018-16588, consider the following steps:
Immediate Steps to Take
- Apply patches provided by SUSE for the affected versions.
- Monitor user creation activities for suspicious behavior.
Long-Term Security Practices
- Regularly update and patch software to prevent vulnerabilities.
- Implement the principle of least privilege to restrict user capabilities.
Patching and Updates
- Install the latest updates and security patches from SUSE to mitigate the vulnerability.