CVE Vulnerabilities

CVE-2017-7501

Improper Link Resolution Before File Access ('Link Following')

Published: Nov 22, 2017 | Modified: Nov 21, 2024
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
4.6 MEDIUM
AV:L/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
7.3 MODERATE
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Ubuntu
LOW

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.

Weakness

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Software

Name Vendor Start Version End Version
Rpm Rpm * 4.13.0.3 (excluding)
Rpm Ubuntu artful *
Rpm Ubuntu cosmic *
Rpm Ubuntu disco *
Rpm Ubuntu eoan *
Rpm Ubuntu esm-apps/xenial *
Rpm Ubuntu esm-infra-legacy/trusty *
Rpm Ubuntu precise/esm *
Rpm Ubuntu trusty *
Rpm Ubuntu trusty/esm *
Rpm Ubuntu upstream *
Rpm Ubuntu xenial *
Rpm Ubuntu yakkety *
Rpm Ubuntu zesty *

Potential Mitigations

  • Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

References