CVE-2017-7549 - OpenCVE

A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.

No CVSS v3.1

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:L/AC:M/Au:N/C:P/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Redhat	Openstack
Openstack	Instack-undercloud

Configuration 1 [-]

AND

cpe:2.3:a:openstack:instack-undercloud:7.2.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:a:openstack:instack-undercloud:6.1.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openstack:11:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:a:openstack:instack-undercloud:5.3.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*

References

Link	Resource
http://www.securityfocus.com/bid/100407	Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:2557
https://access.redhat.com/errata/RHSA-2017:2649
https://access.redhat.com/errata/RHSA-2017:2687
https://access.redhat.com/errata/RHSA-2017:2693
https://access.redhat.com/errata/RHSA-2017:2726
https://bugzilla.redhat.com/show_bug.cgi?id=1477403	Issue Tracking Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: redhat

Published: 2017-09-21T20:00:00Z

Updated: 2018-01-04T19:57:01

Reserved: 2017-04-05T00:00:00

Link: CVE-2017-7549

JSON object: View

NVD Information

Status : Modified

Published: 2017-09-21T21:29:00.447

Modified: 2023-02-12T23:31:08.393

Link: CVE-2017-7549

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openstack:instack-undercloud:7.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "438CD7A3-3F93-4BC8-AE63-B61BD852D406", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*", "matchCriteriaId": "4D4AC996-B340-4A14-86F7-FF83B4D5EC8F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openstack:instack-undercloud:6.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "C766B188-526F-48FD-B9D0-9B6C7B6696C6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openstack:11:*:*:*:*:*:*:*", "matchCriteriaId": "4E9AF77C-5D49-4842-9817-AD710A919073", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openstack:instack-undercloud:5.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "8B62CC2D-0A0E-4E55-9215-83061A608926", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*", "matchCriteriaId": "E722FEF7-58A6-47AD-B1D0-DB0B71B0C7AA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files."}, {"lang": "es", "value": "Se ha encontrado un error en la versi\u00f3n 7.2.0 de instack-undercloud tal y como viene incorporado en Red Hat OpenStack Platform Pike; la versi\u00f3n 6.1.0 en Red Hat OpenStack Platform Oacta y la versi\u00f3n 5.3.0 en Red Hat OpenStack Newton, en donde los scripts de preinstalaci\u00f3n y pol\u00edticas de seguridad emplearon archivos temporales no seguros. Un usuario local podr\u00eda explotar esta vulnerabilidad para llevar a cabo un ataque de enlace simb\u00f3lico que les permita sobrescribir el contenido de archivos arbitrarios."}], "id": "CVE-2017-7549", "lastModified": "2023-02-12T23:31:08.393", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 1.1, "impactScore": 4.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-09-21T21:29:00.447", "references": [{"source": "secalert@redhat.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/100407"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2017:2557"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2017:2649"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2017:2687"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2017:2693"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2017:2726"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1477403"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-377"}], "source": "secalert@redhat.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-59"}], "source": "nvd@nist.gov", "type": "Secondary"}]}