SB20200903110 - Symlink attack in firefox-esr (Alpine package)
Published: September 3, 2020
Security Bulletin ID
SB20200903110
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Symlink attack (CVE-ID: CVE-2019-3880)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to a symlink following issue within the RPC endpoint emulating the Windows registry service API. A remote unprivileged attacker with ability to create a symlink can create a new registry hive file anywhere they have unix permissions to create a new file within a Samba share.
Successful exploitation of this vulnerability may allow an attacker to detect presence of exiting files on the system or perform phishing attacks and trick other users to upload files into insecure locations.Remediation
Install update from vendor's website.