CVE-2019-3689
Medium
Description
The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.
SeverityMedium
CVSS5.1
Exploit probability—
ProductLinux-nfs Nfs-utils
PublishedSep 19, 2019
First seenSep 19, 2019
Weakness typeCWE-276CWE-276
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux-nfs nfs-utils | v ≤ 1.3.0-34.18.1, v ≤ 2.1.1-6.10.2 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.