CVE-2020-15397 – This CVE allows unprivileged users (like the uu... (How to Fix)

Q: What is the severity of CVE-2020-15397?

CVE-2020-15397 has a CVSS score of 7.8 (HIGH). This CVE allows unprivileged users (like the uucp account) to execute arbitrary code with root privileges by placing malicious binaries in writable directories that HylaFAX+ scripts execute from. It affects HylaFAX+ up to version 7.0.2 and HylaFAX Enterprise installations where these directories are improperly secured.

📋 TL;DR

This CVE allows unprivileged users (like the uucp account) to execute arbitrary code with root privileges by placing malicious binaries in writable directories that HylaFAX+ scripts execute from. It affects HylaFAX+ up to version 7.0.2 and HylaFAX Enterprise installations where these directories are improperly secured.

💻 Affected Systems

Products:

HylaFAX+
HylaFAX Enterprise

Versions: HylaFAX+ through 7.0.2, all HylaFAX Enterprise versions

Operating Systems: Linux, Unix-like systems

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems where HylaFAX is installed and configured with the vulnerable directory permissions.

📦 What is this software?

Hylafax Enterprise by Ifax

View all CVEs affecting Hylafax Enterprise →

Hylafax\+ by Hylafax\+ Project

View all CVEs affecting Hylafax\+ →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full system compromise with root-level code execution, allowing attackers to install backdoors, exfiltrate data, or pivot to other systems.

🟠

Likely Case

Local privilege escalation where unprivileged users gain root access on the affected system.

🟢

If Mitigated

No impact if proper directory permissions are enforced and scripts don't execute from user-writable locations.

🌐 Internet-Facing: LOW - This is primarily a local privilege escalation vulnerability requiring local access.

🏢 Internal Only: HIGH - Any user with access to the uucp account or similar unprivileged accounts can escalate to root.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires local access and knowledge of the vulnerable directory structure. The technique is straightforward once an attacker has local access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: HylaFAX+ 7.0.3 and later

Vendor Advisory: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00039.html

Restart Required: Yes

Instructions:

1. Update to HylaFAX+ 7.0.3 or later. 2. Apply vendor patches if available. 3. Restart HylaFAX services after patching.

🔧 Temporary Workarounds

Secure directory permissions

linux

Remove write permissions for unprivileged users on HylaFAX script execution directories

chmod -R o-w /var/spool/hylafax
chown -R root:root /var/spool/hylafax

Restrict uucp account access

linux

Limit the uucp account's ability to write to critical directories

usermod -s /sbin/nologin uucp
chmod 750 /var/spool/hylafax

🧯 If You Can't Patch

Implement strict directory permissions to prevent unprivileged users from writing to /var/spool/hylafax subdirectories
Monitor for unauthorized file creation in HylaFAX directories and restrict uucp account privileges

🔍 How to Verify

Check if Vulnerable:

Check if unprivileged users can write to directories under /var/spool/hylafax: find /var/spool/hylafax -type d -perm -o+w

Check Version:

hfaxd --version 2>/dev/null || faxstat --version 2>/dev/null

Verify Fix Applied:

Verify directory permissions: find /var/spool/hylafax -type d -perm -o+w should return no results

📡 Detection & Monitoring

Log Indicators:

Unexpected file creation in /var/spool/hylafax directories
Unusual process execution from HylaFAX directories by uucp user

Network Indicators:

Outbound connections from HylaFAX processes to unexpected destinations

SIEM Query:

source="/var/log/auth.log" AND (process="hfaxd" OR user="uucp") AND action="execute"

📊 Metadata

CVE ID: CVE-2020-15397

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-732

Published: June 30, 2020

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-15397, you might also want to check these: