PT-2019-2629 · Gnome+7 · Gvfs+7

Malte Kraus + 1 · Published 2019-05-29 · Updated 2024-06-15 · CVE-2019-12447

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GVFS versions 1.29.4 through 1.41.2

Description The issue is related to errors in handling permissions in the daemon/gvfsbackendadmin.c component of the GVFS subsystem in the GNOME desktop environment for Linux operating systems. This can allow a remote attacker to impact the integrity, confidentiality, and availability of protected information. The problem arises because the setfsuid function is not used, leading to mishandling of file ownership.

Recommendations For GVFS versions 1.29.4 through 1.41.2, consider restricting access to the gvfsbackendadmin.c component until a patch is available. As a temporary workaround, avoid using the affected GVFS backend to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-275

Related Identifiers

ALSA-2020:1766

ALT-PU-2019-2363

ALT-PU-2019-2406

ALT-PU-2019-2783

BDU:2019-02514

CESA-2020_1766

CVE-2019-12447

MGASA-2019-0214

OPENSUSE-SU-2019:1697-1

OPENSUSE-SU-2019:1699-1

OPENSUSE-SU-2019_1697-1

OPENSUSE-SU-2019_1699-1

OPENSUSE-SU-2024:10838-1

RHSA-2020:1766

RHSA-2020_1766

RLSA-2020:1766

SUSE-SU-2019:1717-1

SUSE-SU-2019_1717-1

USN-4053-1

Affected Products

Alt Linux

Almalinux

Centos

Gvfs

Red Hat

Rocky Linux

Suse

Ubuntu

References · 152

• https://bdu.fstec.ru/vul/2019-02517 · Security Note
• https://gitlab.gnome.org/GNOME/gvfs/commit/d7d362995aa0cb8905c8d5c2a2a4c305d2ffff80 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12447 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02514 · Security Note
• https://osv.dev/vulnerability/RLSA-2020:1766 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12795 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP6BFQUPQRVRRFIYHFWWB6RHJNEB4LGQ · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-12447 · Security Note
• https://osv.dev/vulnerability/USN-4053-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12447 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12448 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-2406 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1697-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10838-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-2363 · Vendor Advisory