Home / Early Warning / Vulnerabilidades / CVE-2018-19044

CVE-2018-19044

Type: 
Link Following
Severity: 
Low
Publication date: 
11/08/2018
Last modified: 
08/06/2019
Description
keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd.
Impact
Access Vector: Local
Access Complexity: Media
Authentication: Not required to exploit
Impact Type: Partially affects on system integrity + No impact on system confidentiality + Partially affects on system availability
Vulnerable software and versions
  • cpe:2.3:a:keepalived:keepalived:2.0.8:*:*:*:*:*:*:*
To consult the complete list of products and versions see this page
Explanation of fields