Advisories » MGASA-2018-0314

Updated cantata packages fix security vulnerability

Publication date: 13 Jul 2018
Modification date: 13 Jul 2018
Type: security
Affected Mageia releases : 6
CVE: CVE-2018-12559 , CVE-2018-12560 , CVE-2018-12561 , CVE-2018-12562

Description

The mount target path check in mounter.cpp 'mpOk()' is insufficient. A
regular user can this way mount a CIFS filesystem anywhere, and not just
beneath /home by passing relative path components (CVE-2018-12559).

Arbitrary unmounts can be performed by regular users the same way
(CVE-2018-12560).

A regular user can inject additional mount options like file_mode= by
manipulating e.g. the domain parameter of the samba URL (CVE-2018-12561).

The wrapper script 'mount.cifs.wrapper' uses the shell to forward the
arguments to the actual mount.cifs binary. The shell evaluates wildcards
which can also be injected (CVE-2018-12562).

To fix these issues, the vulnerable D-Bus service has been removed.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=23201
• http://openwall.com/lists/oss-security/2018/06/19/1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12559
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12560
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12561
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12562

SRPMS

6/core

• cantata-2.0.1-5.1.mga6