PT-2018-14941 · Gnome+2 · Gnome Keyring+2

Published 2018-11-18 · Updated 2024-08-05 · CVE-2018-19358

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNOME Keyring versions prior to 3.28.2

Description The issue allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked. This occurs because available D-Bus protection mechanisms are not used. The vendor disputes this issue, citing that untrusted applications must not be allowed to access the user's session bus socket.

Recommendations For GNOME Keyring versions prior to 3.28.2, consider restricting access to the D-Bus interface to minimize the risk of exploitation. As a temporary workaround, restrict the use of the Secret Service API call until a patch is available.

Exploit

Fix

Related Identifiers

ALT-PU-2019-1457

CVE-2018-19358

Affected Products

Alt Linux

Debian

Gnome Keyring

References · 18

• 🔥 https://github.com/sungjungk/keyring_crack · Exploit
• 🔥 https://youtube.com/watch?v=Do4E9ZQaPck · Exploit
• 🔥 https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1780365 · Exploit
• https://osv.dev/vulnerability/CVE-2018-19358 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-1457 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19358 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-19358 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-19358 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/gnome-keyring · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-19358 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-19358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19358 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-19358 · Security Note
• https://packages.debian.org/src:gnome-keyring · Note
• https://wiki.gnome.org/Projects/GnomeKeyring/SecurityFAQ · Note