PT-2018-3685 · Packagekit+4 · Packagekit+4

Matthias Gerstner · Published 2018-04-23 · Updated 2024-06-15 · CVE-2018-1106

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PackageKit versions prior to 1.1.10

Description The issue is related to insufficient authentication in PackageKit, allowing a local attacker to bypass authentication and install signed packages without administrator privileges. This can be exploited to install vulnerable packages, potentially leading to further system compromise.

Recommendations For versions prior to 1.1.10, update to version 1.1.10 or later to resolve the issue. As a temporary workaround, consider restricting package installation privileges to prevent unauthorized package installs until the update is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2021-03121

CESA-2018_1224

CVE-2018-1106

DSA-4207-1

OPENSUSE-SU-2018_1049-1

OPENSUSE-SU-2024:10605-1

RHSA-2018:1224

RHSA-2018_1224

SUSE-SU-2018:1047-1

SUSE-SU-2018_1047-1

Affected Products

Centos

Packagekit

Red Hat

Suse

Ubuntu

References · 37

• https://usn.ubuntu.com/3634-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2018-1224.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1106 · Security Note
• https://security-tracker.debian.org/tracker/source-package/packagekit · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1106 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1106 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4207-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1224 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1047-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4207 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3634-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03121 · Security Note
• https://osv.dev/vulnerability/DSA-4207-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1106 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-1106 · Vendor Advisory