pcp: Local privilege escalation from user pcp to root
A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows the user pcp to run code as root by placing it into /var/log/pcp/configs.sh This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
SUSE Linux Enterprise High Performance Computing 15-ESPOS
Vendor
SUSE
Product
SUSE Linux Enterprise High Performance Computing 15-ESPOS
Platforms
Unknown
Default status
Unknown
SUSE Linux Enterprise High Performance Computing 15-ESPOS · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
pcp
affected
custom
3.11.9-5.8.1
Unavailable
None listed
SUSE Linux Enterprise High Performance Computing 15-LTSS
Vendor
SUSE
Product
SUSE Linux Enterprise High Performance Computing 15-LTSS
Platforms
Unknown
Default status
Unknown
SUSE Linux Enterprise High Performance Computing 15-LTSS · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
pcp
affected
custom
3.11.9-5.8.1
Unavailable
None listed
SUSE Linux Enterprise Module for Development Tools 15
Vendor
SUSE
Product
SUSE Linux Enterprise Module for Development Tools 15
Platforms
Unknown
Default status
Unknown
SUSE Linux Enterprise Module for Development Tools 15 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
pcp
affected
custom
3.11.9-5.8.1
Unavailable
None listed
SUSE Linux Enterprise Module for Development Tools 15-SP1
Vendor
SUSE
Product
SUSE Linux Enterprise Module for Development Tools 15-SP1
Platforms
Unknown
Default status
Unknown
SUSE Linux Enterprise Module for Development Tools 15-SP1 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
pcp
affected
custom
4.3.1-3.5.3
Unavailable
None listed
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15
Vendor
SUSE
Product
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15
Platforms
Unknown
Default status
Unknown
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
pcp
affected
custom
3.11.9-5.8.1
Unavailable
None listed
SUSE Linux Enterprise Server 15-LTSS
Vendor
SUSE
Product
SUSE Linux Enterprise Server 15-LTSS
Platforms
Unknown
Default status
Unknown
SUSE Linux Enterprise Server 15-LTSS · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
pcp
affected
custom
3.11.9-5.8.1
Unavailable
None listed
SUSE Linux Enterprise Server for SAP 15
Vendor
SUSE
Product
SUSE Linux Enterprise Server for SAP 15
Platforms
Unknown
Default status
Unknown
SUSE Linux Enterprise Server for SAP 15 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
pcp
affected
custom
3.11.9-5.8.1
Unavailable
None listed
SUSE Linux Enterprise Software Development Kit 12-SP4
Vendor
SUSE
Product
SUSE Linux Enterprise Software Development Kit 12-SP4
Platforms
Unknown
Default status
Unknown
SUSE Linux Enterprise Software Development Kit 12-SP4 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
pcp
affected
custom
3.11.9-6.14.1
Unavailable
None listed
SUSE Linux Enterprise Software Development Kit 12-SP5
Vendor
SUSE
Product
SUSE Linux Enterprise Software Development Kit 12-SP5
Platforms
Unknown
Default status
Unknown
SUSE Linux Enterprise Software Development Kit 12-SP5 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
pcp
affected
custom
3.11.9-6.14.1
Unavailable
None listed
openSUSE Leap 15.1
Vendor
openSUSE
Product
openSUSE Leap 15.1
Platforms
Unknown
Default status
Unknown
openSUSE Leap 15.1 · Scoped product and version facts