PT-2018-13284 · Manjaro · Manjaro-System

Robin Broda · Publicado 2018-08-29 · Atualizado 2019-10-03 · CVE-2018-15912

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions manjaro-system version 20180716-1

Description A local attacker can exploit an issue in the manjaro-update-system.sh script to install or remove arbitrary packages and package repositories. These repositories can contain hooks with arbitrary code that will automatically be run as root. Additionally, an attacker can remove vital system packages.

Recommendations For manjaro-system version 20180716-1, consider restricting access to the package management system to prevent unauthorized installation or removal of packages until a fix is available. As a temporary workaround, monitor system package changes closely to detect and mitigate potential attacks.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2018-15912

Produtos afetados

Manjaro-System

Referências · 4

• 🔥 https://lists.manjaro.org/pipermail/manjaro-security/2018-August/000785.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-15912 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-15912 · Nota de Segurança
• https://gitlab.manjaro.org/packages/core/manjaro-system/commit/8208b8a · Correção