[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: Re: [oss-security] cantata: cantata-mounter D-Bus service local privilege escalation and other secur
From: Matthias Gerstner <mgerstner () suse ! de>
Date: 2018-06-19 7:59:53
Message-ID: 20180619075953.GA8469 () f195 ! suse ! de
[Download RAW message or body]
> A) The mount target path check in mounter.cpp `mpOk()` is insufficient.
> A regular user can this way mount a CIFS filesystem anywhere, and not
> just beneath /home by passing relative path components.
This was assigned CVE-2018-12559.
> B) Arbitrary unmounts can be performed by regular users the same way.
This was assigned CVE-2018-12560.
> C) A regular user can inject additional mount options like file_mode= by
> manipulating e.g. the domain parameter of the samba URL.
This was assigned CVE-2018-12561.
> D) The wrapper script 'mount.cifs.wrapper' uses the shell to forward the
> arguments to the actual mount.cifs binary. The shell evaluates
> wildcards which can also be injected like this:
This was assigned CVE-2018-12562.
["signature.asc" (application/pgp-signature)]
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic