CVE-2017-18018

Published: 04/01/2018 Updated: 19/01/2018

CVSS v2 Base Score: 1.9 | Impact Score: 2.9 | Exploitability Score: 3.4

CVSS v3 Base Score: 4.7 | Impact Score: 3.6 | Exploitability Score: 1

VMScore: 170

Vector: AV:L/AC:M/Au:N/C:N/I:P/A:N

In GNU Coreutils up to and including 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu coreutils

In GNU Coreutils through 829, chown-corec in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition ...

Phonito Security Docker Vulnerability Scanner This action automates scanning Docker images for OS & library vulnerabilities You will need a Phonito Secuirty account which you can get for free at phonitoio Example output: Phonito Scan Complete! ============================================== 4 CVEs present image ============================================== �

Free Docker Vulnerability Scanning for CI/CD integration

Phonito Security Docker Vulnerability Scanner This action automates scanning Docker images for OS & library vulnerabilities You will need a Phonito Secuirty account which you can get for free at phonitoio Example output: Phonito Scan Complete! ============================================== 4 CVEs present image ============================================== �

CWE-362 http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html https://nvd.nist.gov https://github.com/actions-marketplace-validations/phonito_phonito-scanner-action https://github.com/phonito/phonito-scanner-action https://access.redhat.com/security/cve/cve-2017-18018

CVE-2017-18018

Vulnerability Summary

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect