Description

A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the start script of openldap2 of SUSE Enterprise Storage 5, SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SECURITY, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to escalate privileges from user ldap to root. This issue affects: SUSE Enterprise Storage 5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Debuginfo 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Debuginfo 11-SP4 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Point of Sale 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 11-SECURITY openldap2-client-openssl1 versions prior to 2.4.26-0.74.13.1. SUSE Linux Enterprise Server 11-SP4-LTSS openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 12-SP2-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP2-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP4 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.31.1. SUSE Linux Enterprise Server for SAP 12-SP2 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 12-SP3 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.31.1. SUSE OpenStack Cloud 7 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud 8 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud Crowbar 8 openldap2 versions prior to 2.4.41-18.71.2. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.12.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.3.1.

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  7.8 HIGH

Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CNA:  SUSE

Base Score:  7.7 HIGH

Vector:  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score:  7.2 HIGH

Vector:  (AV:L/AC:L/Au:N/C:C/I:C/A:C)

https://bugzilla.suse.com/show_bug.cgi?id=1172698

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NIST (AV:L/AC:L/Au:N/C:C/I:C/A:C)

AND
     OR
          *cpe:2.3:a:opensuse:openldap2:*:*:*:*:*:*:*:* versions up to (excluding) 2.4.26-0.74.13.1
     OR
          cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*
          cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*
          cpe:2.3:a:suse:linux_enterprise_point_of_sale:11:sp3:*:*:*:*:*:*
          cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*
          cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss:*:*:*

AND
     OR
          *cpe:2.3:a:opensuse:openldap2:*:*:*:*:*:*:*:* versions up to (excluding) 2.4.41-18.71.2
     OR
          cpe:2.3:a:suse:enterprise_storage:5.0:*:*:*:*:*:*:*
          cpe:2.3:a:suse:openstack_cloud:7.0:*:*:*:*:*:*:*
          cpe:2.3:a:suse:openstack_cloud:8.0:*:*:*:*:*:*:*
          cpe:2.3:a:suse:openstack_cloud_crowbar:8.0:*:*:*:*:*:*:*
          cpe:2.3:o:suse:linux_enterprise_server:12:sp2:*:*:*:*:*:*
          cpe:2.3:o:suse:linux_enterprise_server:12:sp2:*:*:*:sap:*

AND
     OR
          *cpe:2.3:a:opensuse:openldap2:*:*:*:*:*:*:*:* versions up to (excluding) 2.4.46-9.31.1
     OR
          cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:ltss:*:*
          cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:sap:*:*

AND
     OR
          *cpe:2.3:a:opensuse:openldap2:*:*:*:*:*:*:*:* versions up to (excluding) 2.4.46-lp151.10.12.1
     OR
          cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
          cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*

https://bugzilla.suse.com/show_bug.cgi?id=1172698 No Types Assigned

https://bugzilla.suse.com/show_bug.cgi?id=1172698 Exploit, Issue Tracking, Vendor Advisory