CVE-2020-15396: 
Linux Debian vulnerability analysis and mitigation

CVE-2020-15396 affects HylaFAX+ through version 7.0.2 and HylaFAX Enterprise. The vulnerability was discovered in June 2020 and involves the faxsetup utility which calls chown on files in user-owned directories. This security flaw affects the core functionality of the fax server system (NVD).

The vulnerability stems from a race condition in the faxsetup utility where it performs chown operations on files in user-owned directories. The issue is specifically located in the setupfax script where it executes chown and chmod operations on configuration files in directories that can be manipulated by the uucp user. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD, SUSE Bug).

By exploiting this vulnerability, a local attacker could escalate their privileges to root through a race condition attack. This allows an attacker to manipulate file ownership and potentially gain unauthorized access to sensitive system files (NVD, Gentoo Security).

The vulnerability is locally exploitable and requires low attack complexity. A proof of concept exists demonstrating how an attacker with uucp user privileges can exploit the race condition to gain ownership of sensitive files like /etc/shadow. The attack is reported to be 100% stable on affected systems (SUSE Bug).

The vulnerability was fixed in HylaFAX+ version 7.0.3. The fix includes secure temporary directory creation for faxsetup, faxaddmodem, and probemodem utilities. Users are advised to upgrade to version 7.0.3 or later. Various Linux distributions have released security updates to address this vulnerability (Gentoo Security, HylaFAX Patch).