PT-2018-1887 · Gnome+2 · Gnome Librsvg+2

Alex Birsan · Published 2017-12-31 · Updated 2019-10-03 · CVE-2018-1000041

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNOME librsvg versions prior to commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea

Description The issue is related to improper input validation in the rsvg-io.c file, which can lead to the leakage of a victim's Windows username and NTLM password hash to remote attackers through SMB. This can be exploited by processing a specially crafted SVG file containing a UNC path on Windows. The vulnerability is associated with an error in input data validation, allowing a remote attacker to intercept the victim's Windows username and NTLM password hash via SMB.

Recommendations For versions prior to commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea, consider avoiding the processing of SVG files from untrusted sources until a patch is available. As a temporary workaround, restrict access to SMB shares to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

ALT-PU-2017-2857

BDU:2018-01491

CVE-2018-1000041

DLA-1278-1

MGASA-2018-0291

MGASA-2018-0297

OPENSUSE-SU-2018_1310-1

SUSE-SU-2018:1288-1

SUSE-SU-2018_1288-1

Affected Products

Alt Linux

Gnome Librsvg

Suse

References · 26

• https://advisories.mageia.org/MGASA-2018-0297.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000041 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:1288-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00123 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0297 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-2857 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0291.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000041 · Security Note
• https://bdu.fstec.ru/vul/2018-01491 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000041 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20446 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0291 · Vendor Advisory
• https://github.com/GNOME/librsvg/commit/c6ddf2ed4d768fd88adbea2b63f575cd523022ea · Note
• https://github.com/ImageMagick/librsvg/commit/f9d69eadd2b16b00d1a1f9f286122123f8e547dd · Note
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note