A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.
Se encontró una vulnerabilidad en GNU Nano que permite una posible escalada de privilegios a través de un archivo temporal inseguro. Si Nano muere mientras edita, un archivo que guarda en un archivo de emergencia con los permisos del usuario que lo ejecuta brinda una ventana de oportunidad para que los atacantes aumenten los privilegios a través de un enlace simbólico malicioso.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | LOW |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-59
|
| [email protected] | Secondary |
en
CWE-59
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| gnu | nano | * | <built-in method update of dict object at 0x7fd36b154bc0> | Application |
| redhat | enterprise_linux | 6.0 | <built-in method update of dict object at 0x7fd39c4a4700> | Operating System |
| redhat | enterprise_linux | 7.0 | <built-in method update of dict object at 0x7fd3844a02c0> | Operating System |
| redhat | enterprise_linux | 8.0 | <built-in method update of dict object at 0x7fd2dbcabf00> | Operating System |
| redhat | enterprise_linux | 9.0 | <built-in method update of dict object at 0x7fd36b157480> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:gnu:nano:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |