PT-2019-2629 · Gnome+7 · Gvfs+7
Malte Kraus
+1
·
Publicado
2019-05-29
·
Atualizado
2024-06-15
·
CVE-2019-12447
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
GVFS versions 1.29.4 through 1.41.2
Description
The issue is related to errors in handling permissions in the daemon/gvfsbackendadmin.c component of the GVFS subsystem in the GNOME desktop environment for Linux operating systems. This can allow a remote attacker to impact the integrity, confidentiality, and availability of protected information. The problem arises because the setfsuid function is not used, leading to mishandling of file ownership.
Recommendations
For GVFS versions 1.29.4 through 1.41.2, consider restricting access to the
gvfsbackendadmin.c component until a patch is available. As a temporary workaround, avoid using the affected GVFS backend to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability. Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Gvfs
Red Hat
Rocky Linux
Suse
Ubuntu