CVE-2018-14650

Impact:
Moderate
Public Date:
2018-09-27
CWE:
CWE-732
Bugzilla:
1633243: CVE-2018-14650 sos-collector: incorrect permissions set on newly created files
It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory.

Find out more about CVE-2018-14650 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v3 metrics

CVSS3 Base Score 5.9
CVSS3 Base Metrics CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality High
Integrity Impact None
Availability Impact None

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux 7 (sos-collector) RHSA-2018:3663 2018-11-27

Acknowledgements

This issue was discovered by Riccardo Schirone (Red Hat Product Security).
Last Modified