CVE-2019-18900 : What You Need to Know

SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, and SUSE Linux Enterprise Server 15 are affected by a vulnerability in the libzypp component that allows local attackers to access private cookies due to incorrect default permissions.

Understanding CVE-2019-18900

This CVE involves a security issue in the libzypp component across multiple SUSE products.

What is CVE-2019-18900?

The vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, and SUSE Linux Enterprise Server 15 enables local attackers to read a cookie store, potentially exposing private cookies.

The Impact of CVE-2019-18900

The vulnerability has a CVSS base score of 4 (Medium severity) with low confidentiality impact and no integrity impact. Attack complexity is low, and no user interaction or privileges are required.

Technical Details of CVE-2019-18900

This section provides more technical insights into the CVE.

Vulnerability Description

The vulnerability arises from incorrect default permissions in the libzypp component, allowing unauthorized access to a cookie store.

Affected Systems and Versions

SUSE CaaS Platform 3.0: libzypp versions prior to 16.21.2-27.68.1
SUSE Linux Enterprise Server 12: libzypp versions prior to 16.21.2-2.45.1
SUSE Linux Enterprise Server 15: libzypp version 17.19.0-3.34.1

Exploitation Mechanism

Local attackers can exploit the vulnerability to access and read the cookie store used by libzypp, potentially exposing sensitive cookies.

Mitigation and Prevention

Protecting systems from CVE-2019-18900 requires immediate actions and long-term security practices.

Immediate Steps to Take

Apply patches provided by SUSE to fix the vulnerability.
Monitor for any unauthorized access or unusual activities on the affected systems.

Long-Term Security Practices

Regularly update and patch software to address security vulnerabilities.
Implement least privilege access controls to limit unauthorized access to sensitive data.

Patching and Updates

Ensure that all affected systems are updated with the latest patches from SUSE to mitigate the vulnerability.