CVE-2018-14650: redhat enterprise_linux_desktop

Vulnerability summary

CVE-2018-14650 is a medium (CVSS 5.9) vulnerability in redhat enterprise_linux_desktop. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-09-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory.

• CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
• CWE-276Incorrect Default PermissionsDuring installation, installed file permissions are set to allow anyone to modify those files.