Bug 1161181

Summary:	VUL-0: CVE-2020-7211: xen: potential directory traversal using relative paths via tftp server on Windows host
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Alexandros Toptsoglou <atoptsoglou>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	carlos.lopez, carnold, smash_bz
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/251288/
Whiteboard:	CVSSv2:NVD:CVE-2020-7211:5.0:(AV:N/AC:L/Au:N/C:P/I:N/A:N) CVSSv3.1:NVD:CVE-2020-7211:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) CVSSv3.1:RedHat:CVE-2020-7211:3.8:(AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) CVSSv3.1:SUSE:CVE-2020-7211:5.1:(AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Alexandros Toptsoglou 2020-01-17 12:14:13 UTC

+++ This bug was initially created as a clone of Bug #1161180 +++

CVE-2020-7211

A potential directory traversal issue was found in the tftp server
of the SLiRP user-mode networking implementation used by QEMU.
It could occur on Windows host, as it allows to use both forward ('/')
and backward slash('\') tokens as separators in a file path.

A user able to access the tftp server could use this flaw to access
undue files by using relative paths.

Upstream patch:
---------------
  -> https://gitlab.freedesktop.org/slirp/libslirp/commit/14ec36e107a8c9af7d0a80c3571fe39b291ff1d4

Reference:
----------
  -> https://www.openwall.com/lists/oss-security/2020/01/17/2

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1792130
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-7211
http://seclists.org/oss-sec/2020/q1/15
https://gitlab.freedesktop.org/slirp/libslirp/commit/14ec36e107a8c9af7d0a80c3571fe39b291ff1d4

Comment 1 Alexandros Toptsoglou 2020-01-17 12:22:02 UTC

Tracked as affected:

SLE11-SP1-TD
SLE11-SP3-TD
SLE11-SP4
SLE12-SP1,2,3,4,5

Comment 5 Swamp Workflow Management 2020-02-06 14:15:37 UTC

SUSE-SU-2020:0334-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1152497,1154448,1154456,1154458,1154461,1155945,1157888,1158003,1158004,1158005,1158006,1158007,1161181
CVE References: CVE-2018-12207,CVE-2019-11135,CVE-2019-18420,CVE-2019-18421,CVE-2019-18424,CVE-2019-18425,CVE-2019-19577,CVE-2019-19578,CVE-2019-19579,CVE-2019-19580,CVE-2019-19581,CVE-2019-19583,CVE-2020-7211
Sources used:
SUSE OpenStack Cloud 7 (src):    xen-4.7.6_06-43.59.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    xen-4.7.6_06-43.59.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    xen-4.7.6_06-43.59.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    xen-4.7.6_06-43.59.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 6 Swamp Workflow Management 2020-02-17 17:14:15 UTC

SUSE-SU-2020:0388-1: An update that fixes 25 vulnerabilities is now available.

Category: security (important)
Bug References: 1115045,1126140,1126141,1126192,1126195,1126196,1126201,1135905,1143797,1145652,1146874,1149813,1152497,1154448,1154456,1154458,1154461,1155945,1157888,1158003,1158004,1158005,1158006,1158007,1161181
CVE References: CVE-2018-12207,CVE-2018-19965,CVE-2019-11135,CVE-2019-12067,CVE-2019-12068,CVE-2019-12155,CVE-2019-14378,CVE-2019-15890,CVE-2019-17340,CVE-2019-17341,CVE-2019-17342,CVE-2019-17343,CVE-2019-17344,CVE-2019-17347,CVE-2019-18420,CVE-2019-18421,CVE-2019-18424,CVE-2019-18425,CVE-2019-19577,CVE-2019-19578,CVE-2019-19579,CVE-2019-19580,CVE-2019-19581,CVE-2019-19583,CVE-2020-7211
Sources used:
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    xen-4.5.5_28-22.64.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    xen-4.5.5_28-22.64.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 8 Swamp Workflow Management 2020-04-29 16:28:30 UTC

SUSE-SU-2020:1138-1: An update that solves 6 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1027519,1155200,1160932,1161181,1167152,1168140,1168142,1168143,1169392
CVE References: CVE-2020-11739,CVE-2020-11740,CVE-2020-11741,CVE-2020-11742,CVE-2020-11743,CVE-2020-7211
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    xen-4.11.3_04-2.23.1
SUSE Linux Enterprise Server 12-SP4 (src):    xen-4.11.3_04-2.23.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 9 Swamp Workflow Management 2020-04-29 17:05:04 UTC

SUSE-SU-2020:1139-1: An update that solves 6 vulnerabilities and has 8 fixes is now available.

Category: security (important)
Bug References: 1027519,1134506,1155200,1157490,1160932,1161181,1162040,1165206,1167007,1167152,1168140,1168142,1168143,1169392
CVE References: CVE-2020-11739,CVE-2020-11740,CVE-2020-11741,CVE-2020-11742,CVE-2020-11743,CVE-2020-7211
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    xen-4.12.2_04-3.11.1
SUSE Linux Enterprise Server 12-SP5 (src):    xen-4.12.2_04-3.11.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Swamp Workflow Management 2020-06-16 19:13:06 UTC

SUSE-SU-2020:1630-1: An update that fixes 12 vulnerabilities is now available.

Category: security (important)
Bug References: 1157888,1158003,1158004,1158005,1158006,1158007,1161181,1167152,1168140,1168142,1169392,1172205
CVE References: CVE-2019-19577,CVE-2019-19578,CVE-2019-19579,CVE-2019-19580,CVE-2019-19581,CVE-2019-19583,CVE-2020-0543,CVE-2020-11739,CVE-2020-11740,CVE-2020-11741,CVE-2020-11742,CVE-2020-7211
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    xen-4.9.4_06-3.62.1
SUSE OpenStack Cloud 8 (src):    xen-4.9.4_06-3.62.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    xen-4.9.4_06-3.62.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    xen-4.9.4_06-3.62.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    xen-4.9.4_06-3.62.1
SUSE Enterprise Storage 5 (src):    xen-4.9.4_06-3.62.1
HPE Helion Openstack 8 (src):    xen-4.9.4_06-3.62.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 13 Swamp Workflow Management 2020-08-04 19:40:36 UTC

SUSE-SU-2020:14444-1: An update that fixes 16 vulnerabilities is now available.

Category: security (important)
Bug References: 1152497,1154448,1154456,1154458,1154461,1155945,1157888,1158004,1158005,1158006,1158007,1161181,1163019,1168140,1169392,1174543
CVE References: CVE-2018-12207,CVE-2019-11135,CVE-2019-18420,CVE-2019-18421,CVE-2019-18424,CVE-2019-18425,CVE-2019-19577,CVE-2019-19578,CVE-2019-19579,CVE-2019-19580,CVE-2019-19583,CVE-2020-11740,CVE-2020-11741,CVE-2020-11742,CVE-2020-7211,CVE-2020-8608
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    xen-4.4.4_42-61.52.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    xen-4.4.4_42-61.52.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 14 Swamp Workflow Management 2020-08-11 16:18:31 UTC

SUSE-SU-2020:14448-1: An update that fixes 7 vulnerabilities is now available.

Category: security (important)
Bug References: 1154456,1154458,1161181,1163019,1168140,1169392,1174543
CVE References: CVE-2019-18421,CVE-2019-18425,CVE-2020-11740,CVE-2020-11741,CVE-2020-11742,CVE-2020-7211,CVE-2020-8608
JIRA References: 
Sources used:
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    xen-4.2.5_22-45.36.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    xen-4.2.5_22-45.36.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 17 Charles Arnold 2021-01-22 19:36:15 UTC

Backported and released to 11-SP1.

Comment 18 Carlos López 2022-06-10 09:35:04 UTC

Done, closing.