VDB
CVE-2020-10737
CVE-2020-10737
PUBLISHED
A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home's user without properly checking the homedir path. This flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then has its ownership transferred to the new home directory's unprivileged user.
EPSS 0.11% · 29.6th percentile
Risk Scores
EPSS Score
0.11%
29.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:Pro:16.04:LTS | oddjob | 0, 0.34.3-1, 0.34.3-2 |
| Ubuntu:Pro:20.04:LTS | oddjob | 0, 0.34.4-1 |
| Ubuntu:Pro:18.04:LTS | oddjob | 0, 0.34.3-4 |
Exploit Intelligence
Timeline
- May 27, 2020 CVE Published
- May 27, 2020 PoC Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2020-10737 third-party-advisory
- https://pagure.io/oddjob/c/10b8aaa1564b723a005b53acc069df71313f4cac third-party-advisory
- https://ubuntu.com/security/notices/USN-5169-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2020-10737 third-party-advisory