SUSE-SU-2024:1629-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2024:1629-1

HIGH7.3

Security update for SUSE Manager Client Tools Beta

Published May 14, 2024

Modified 1 months ago

Fix available

Details

Description of the patch:

This update for SUSE Manager Client Tools Beta fixes the following issues:

Changed codestream origin of SUSE Manager Client Tools Beta (no source changes)

icinga in SUSE Manager Client Tools Beta also received the following security fixes:

CVE-2016-9566: Fixed root privilege escalation (bsc#1014637)
CVE-2019-3698 : Symbolic Link (Symlink) following vulnerability in the cronjob allows local attackers to cause cause DoS or potentially escalate privileges by winning a race (bsc#1156309)

Affected Packages(21 packages)

libzmq3

SUSE Linux Enterprise High Performance Computing 12SUSE Linux Enterprise Module for Advanced Systems Management 12SUSE Linux Enterprise Server 12SUSE Linux Enterprise Server 12 SP3SUSE Linux Enterprise Server 12 SP4

Fixed in:

0:4.0.4-15.8.1

sysuser-shadow

SUSE Linux Enterprise High Performance Computing 12 SP5SUSE Linux Enterprise Module for Containers 12SUSE Manager Client Tools 12SUSE Manager Client Tools 12-BETA

Fixed in:

0:2.0-1.9.1

sysuser-tools

SUSE Linux Enterprise High Performance Computing 12 SP5

Fixed in:

0:2.0-1.9.1

zeromq-devel

SUSE Linux Enterprise Software Development Kit 12 SP5

Fixed in:

0:4.0.4-15.8.1

grafana-ha-cluster-dashboards

SUSE Manager Client Tools 12SUSE Manager Client Tools 12-BETA

Fixed in:

0:1.1.0+git.1605027022.a84d536-1.10.1

grafana-sap-netweaver-dashboards

SUSE Manager Client Tools 12SUSE Manager Client Tools 12-BETA

Fixed in:

0:1.0.3+git.1601889366.9f71957-1.10.1

grafana-sap-providers

SUSE Manager Client Tools 12SUSE Manager Client Tools 12-BETA

Fixed in:

0:1.1-1.7.1

grafana-sleha-provider

SUSE Manager Client Tools 12SUSE Manager Client Tools 12-BETA

Fixed in:

0:1.1.0+git.1605027022.a84d536-1.10.1

hwdata

SUSE Manager Client Tools 12

Fixed in:

0:0.314-10.14.1

icinga

SUSE Manager Client Tools 12SUSE Manager Client Tools 12-BETA

Fixed in:

0:1.13.3-12.8.1

References

https://bugzilla.suse.com/1014637

https://bugzilla.suse.com/1156309

https://lists.suse.com/pipermail/sle-updates/2024-May/035252.html

https://www.suse.com/security/cve/CVE-2016-9566/

https://www.suse.com/security/cve/CVE-2019-3698/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2024/suse-su-20241629-1/

CVSS Analysis

CVSS v3.0

7.3

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

7.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Upstream

CVE-2016-9566 CVE-2019-3698

Ecosystems(18)

SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Module for Advanced Systems Management 12 SUSE Linux Enterprise Module for Containers 12 SUSE Linux Enterprise Server 12

Timeline

PublishedMay 14, 2024

ModifiedSep 20, 2026