CVE-2017-7500

Description

It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.

Risk Information

Base Score

7.8

MODERATE

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.054

Associated Vulnerability

Vulnerability	OS Platform
Multiple Vulnerabilities are affected in IBM WebMethods Integration Server 10.15	Windows
Multiple Vulnerabilities are affected in IBM WebMethods Integration Server 10.11	Windows
Multiple Vulnerabilities are affected in IBM WebMethods Integration Server 11.1	Windows
SUSE-SU-2018:3286-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-4.11.2-16.16.1.x86_64.rpm	Linux
SUSE-SU-2018:3286-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-32bit-4.11.2-16.16.1.x86_64.rpm	Linux
SUSE-SU-2018:3286-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-build-4.11.2-16.16.1.x86_64.rpm	Linux
SUSE-SU-2018:3286-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-build-debuginfo-4.11.2-16.16.1.x86_64.rpm	Linux
SUSE-SU-2018:3286-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-debuginfo-4.11.2-16.16.1.x86_64.rpm	Linux
SUSE-SU-2018:3286-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-debuginfo-32bit-4.11.2-16.16.1.x86_64.rpm	Linux
SUSE-SU-2018:3286-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-debugsource-4.11.2-16.16.1.x86_64.rpm	Linux
SUSE-SU-2018:3286-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-python-4.11.2-16.16.1.x86_64.rpm	Linux
SUSE-SU-2018:3286-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-python-debuginfo-4.11.2-16.16.1.x86_64.rpm	Linux
SUSE-SU-2018:3286-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-python-debugsource-4.11.2-16.16.1.x86_64.rpm	Linux
SUSE-SU-2018:3286-1(SUSE Linux Enterprise Server 12-SP3 ) python3-rpm-4.11.2-16.16.1.x86_64.rpm	Linux
SUSE-SU-2018:3286-1(SUSE Linux Enterprise Server 12-SP3 ) python3-rpm-debuginfo-4.11.2-16.16.1.x86_64.rpm	Linux
SUSE-SU-2018:3286-1(SUSE Linux Enterprise Server 12-SP3 ) python3-rpm-debugsource-4.11.2-16.16.1.x86_64.rpm	Linux
SUSE-SU-2018:3884-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-4.11.2-16.21.1.x86_64.rpm	Linux
SUSE-SU-2018:3884-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-32bit-4.11.2-16.21.1.x86_64.rpm	Linux
SUSE-SU-2018:3884-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-build-4.11.2-16.21.1.x86_64.rpm	Linux
SUSE-SU-2018:3884-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-build-debuginfo-4.11.2-16.21.1.x86_64.rpm	Linux
SUSE-SU-2018:3884-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-debuginfo-4.11.2-16.21.1.x86_64.rpm	Linux
SUSE-SU-2018:3884-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-debuginfo-32bit-4.11.2-16.21.1.x86_64.rpm	Linux
SUSE-SU-2018:3884-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-debugsource-4.11.2-16.21.1.x86_64.rpm	Linux
SUSE-SU-2018:3884-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-python-4.11.2-16.21.1.x86_64.rpm	Linux
SUSE-SU-2018:3884-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-python-debuginfo-4.11.2-16.21.1.x86_64.rpm	Linux
SUSE-SU-2018:3884-1(SUSE Linux Enterprise Desktop 12-SP3 ) rpm-python-debugsource-4.11.2-16.21.1.x86_64.rpm	Linux
SUSE-SU-2018:3884-1(SUSE Linux Enterprise Server 12-SP3 ) python3-rpm-4.11.2-16.21.1.x86_64.rpm	Linux
SUSE-SU-2018:3884-1(SUSE Linux Enterprise Server 12-SP3 ) python3-rpm-debuginfo-4.11.2-16.21.1.x86_64.rpm	Linux
SUSE-SU-2018:3884-1(SUSE Linux Enterprise Server 12-SP3 ) python3-rpm-debugsource-4.11.2-16.21.1.x86_64.rpm	Linux
Improper Link Resolution Before File Access (Link Following) Vulnerability (CVE-2017-7500)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234