CVE-2019-3688

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise Server 15 versions prior to 4.8-5.8.1 SUSE Linux Enterprise Server 12 versions prior to 3.5.21-26.17.1

Description The issue concerns the /usr/sbin/pinger binary packaged with squid, which had squid:root and 0750 permissions. This allowed an attacker who compromised the squid user to gain persistence by modifying the binary.

Recommendations For SUSE Linux Enterprise Server 15 versions prior to 4.8-5.8.1, update to version 4.8-5.8.1 or later to resolve the issue. For SUSE Linux Enterprise Server 12 versions prior to 3.5.21-26.17.1, update to version 3.5.21-26.17.1 or later to resolve the issue.