CVE-2020-24332: High severity ibm cloud pak for security vulnerability
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which could possibly lead to a DoS attack.
Other sources
TrouSerS could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a flaw in the tscd Daemon. By using symlink attacks, an attacker could exploit this vulnerability to create or corrupt existing files.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-24332?
CVE-2020-24332 is a vulnerability in TrouSerS that could allow a remote authenticated attacker to gain elevated privileges on the system.
What is the severity of CVE-2020-24332?
CVE-2020-24332 has a severity rating of 7.1 (high).
Which software versions are affected by CVE-2020-24332?
IBM Cloud Pak for Security (CP4S) versions 1.7.2.0, 1.7.1.0, and 1.7.0.0, as well as Trustedcomputinggroup Trousers version 0.3.14 and Fedoraproject Fedora version 33 are affected by CVE-2020-24332.
How can an attacker exploit CVE-2020-24332?
CVE-2020-24332 can be exploited by a remote authenticated attacker to perform symlink attacks and create or corrupt files, potentially leading to a denial-of-service (DoS) attack.
Are there any references for CVE-2020-24332?
Yes, you can find more information about CVE-2020-24332 at the following references: [1](http://www.openwall.com/lists/oss-security/2020/08/14/1), [2](https://bugzilla.suse.com/show_bug.cgi?id=1164472), [3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SSDL7COIFCZQMUBNAASNMKMX7W5JUHRD/).