PT-2018-11561 · Linux Mint+2 · Cinnamon+2

Mgerstner · Publicado 2018-07-02 · Atualizado 2021-03-15 · CVE-2018-13054

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cinnamon versions 1.9.2 through 3.8.6

Description An issue was discovered where the cinnamon-settings-users.py GUI, running as root, allows configuration of other users' icon files. This can lead to arbitrary file overwrites if an unprivileged user prepares a symlink to a target location. The icon files are written to the respective user's $HOME/.face location.

Recommendations For Cinnamon versions 1.9.2 through 3.8.6, consider restricting access to the cinnamon-settings-users.py GUI to prevent unprivileged users from preparing symlinks that could lead to arbitrary file overwrites. As a temporary workaround, consider disabling the on face browse menuitem activated and on face menuitem activated functions until a patch is available.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2018-13054

DLA-1420-1

MGASA-2019-0063

OPENSUSE-SU-2018_2121-1

OPENSUSE-SU-2018_2125-1

USN-4844-1

Produtos afetados

Cinnamon

Suse

Ubuntu

Referências · 19

• https://github.com/linuxmint/Cinnamon/pull/7683 · Correção
• https://github.com/linuxmint/Cinnamon/commit/66e54f43f179fdf041a3e5232178a9910963cfb5 · Nota
• https://cve.org/CVERecord?id=CVE-2018-13054 · Nota de Segurança
• https://bugzilla.suse.com/show_bug.cgi?id=1083067 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-13054 · Nota de Segurança
• https://lists.debian.org/debian-lts-announce/2018/07/msg00011.html · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/XSADMZDE26IBCLBJOASR5ZX4E2OKKPVD · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4844-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-13054 · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-1420-1 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2019-0063.html · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-13054 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-13054 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=23272 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-13054 · Aviso do Fabricante