CVE-2021-41037

In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually require particular attention in term of security. Although p2 has built-in strategies to ensure artifacts are signed and then to help establish trust, there is no such strategy for the metadata part that does configure such touchpoints. As a result, it's possible to install a unit that will run malicious code during installation without user receiving any warning about this installation step being risky when coming from untrusted source.

CVSS v3 10.0 CRITICAL
CVSS v2.0 6.8 MEDIUM

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugs.eclipse.org/bugs/show_bug.cgi?id=577029	Mailing List Vendor Advisory
https://github.com/eclipse-equinox/p2/issues/235
https://bugs.eclipse.org/bugs/show_bug.cgi?id=577029	Mailing List Vendor Advisory
https://github.com/eclipse-equinox/p2/issues/235

Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:equinox_p2:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-07-08 04:15

Updated : 2024-11-21 06:25

NVD link : CVE-2021-41037

Mitre link : CVE-2021-41037

CVE.ORG link : CVE-2021-41037

JSON object : View

Products Affected

eclipse

equinox_p2

CWE

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

{"id": "CVE-2021-41037", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "published": "2022-07-08T04:15:13.833", "references": [{"url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=577029", "tags": ["Mailing List", "Vendor Advisory"], "source": "emo@eclipse.org"}, {"url": "https://github.com/eclipse-equinox/p2/issues/235", "source": "emo@eclipse.org"}, {"url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=577029", "tags": ["Mailing List", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/eclipse-equinox/p2/issues/235", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-829"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually require particular attention in term of security. Although p2 has built-in strategies to ensure artifacts are signed and then to help establish trust, there is no such strategy for the metadata part that does configure such touchpoints. As a result, it's possible to install a unit that will run malicious code during installation without user receiving any warning about this installation step being risky when coming from untrusted source."}, {"lang": "es", "value": "En Eclipse p2, las unidades instalables son capaces de alterar la instalaci\u00f3n de la plataforma Eclipse y la m\u00e1quina local por medio de puntos de contacto durante la instalaci\u00f3n. Esos puntos de contacto pueden, por ejemplo, alterar la l\u00ednea de comandos usada para iniciar la aplicaci\u00f3n, inyectando cosas como el agente u otras configuraciones que suelen requerir especial atenci\u00f3n en t\u00e9rminos de seguridad. Aunque p2 presenta estrategias incorporadas para asegurar que los artefactos est\u00e9n firmados y as\u00ed ayudar a establecer confianza, no se presenta ninguna estrategia de este tipo para la parte de los metadatos que configuran dichos puntos de contacto. Como resultado, es posible instalar una unidad que ejecutar\u00e1 c\u00f3digo malicioso durante la instalaci\u00f3n sin que el usuario reciba ninguna advertencia sobre que este paso de instalaci\u00f3n es arriesgado cuando proviene de una fuente no confiable"}], "lastModified": "2024-11-21T06:25:19.923", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:equinox_p2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "82D19D5B-3327-4797-A09C-A32EC26D1342", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}