SecuriTricks - CVE-2024-52869

Description

Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. Specifically, when there is an operating system move from SUSE Enterprise Linux Server (SLES) 12 Service Pack (SP) 2 or 3 to SLES 15 SP2 on Teradata Database systems, some service/system user accounts, and possibly systems administrator created user accounts, are incorrectly assigned to groups that allow higher system-level privileges than intended for those user accounts. Depending on the usage of these accounts, this may lead to full system compromise.

Product(s) Impacted

Product	Versions
SUSE Enterprise Linux Server	['12 Service Pack 2', '12 Service Pack 3', '15 Service Pack 2']
Teradata Database systems	[]

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-281

Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

References

https://chrismanson.com/CVE/cve-2024-52869.html

https://www.teradata.com/trust-security-center/data-security

CVSS Score

6.0 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: HIGH
Privileges Required: LOW
Scope: CHANGED
Confidentiality Impact: LOW
Integrity Impact: LOW
Availability Impact: LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

View Vector String

Timeline

Published: Jan. 8, 2025, 9:15 p.m.
Last Modified: Jan. 31, 2025, 6:15 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

cve@mitre.org

CVE-2024-52869