PT-2018-13284 · Manjaro · Manjaro-System

Robin Broda · Published 2018-08-29 · Updated 2019-10-03 · CVE-2018-15912

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions manjaro-system version 20180716-1

Description A local attacker can exploit an issue in the manjaro-update-system.sh script to install or remove arbitrary packages and package repositories. These repositories can contain hooks with arbitrary code that will automatically be run as root. Additionally, an attacker can remove vital system packages.

Recommendations For manjaro-system version 20180716-1, consider restricting access to the package management system to prevent unauthorized installation or removal of packages until a fix is available. As a temporary workaround, monitor system package changes closely to detect and mitigate potential attacks.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2018-15912

Affected Products

Manjaro-System

References · 4

• 🔥 https://lists.manjaro.org/pipermail/manjaro-security/2018-August/000785.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-15912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15912 · Security Note
• https://gitlab.manjaro.org/packages/core/manjaro-system/commit/8208b8a · Patch