Ubuntu: Security Advisory (USN-4134-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 LTS / 18.04 LTS : IBus vulnerability (USN-4134-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4134-1 advisory. Simon McVittie discovered that IBus did not enforce appropriate access controls on its private D-Bus socket. A local unprivileged user who discovers t...

USN-4134-1: IBus vulnerability

Simon McVittie discovered that IBus did not enforce appropriate access controls on its private D-Bus socket. A local unprivileged user who discovers the IBus socket address of another user could exploit this to capture the key strokes of the other user...

EulerOS 2.0 SP5 : gvfs (EulerOS-SA-2019-1907)

According to the version of the gvfs packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket witho...

GLSA-201909-08 : D-Bus: Authentication bypass

The remote host is affected by the vulnerability described in GLSA-201909-08 D-Bus: Authentication bypass It was discovered that a local attacker could manipulate symbolic links in their own home directory to bypass authentication and connect to a DBusServer with elevated privileges. Impact : A...

D-Bus: Authentication bypass

Background D-Bus is a message bus system which processes can use to talk to each other. Description It was discovered that a local attacker could manipulate symbolic links in their own home directory to bypass authentication and connect to a DBusServer with elevated privileges. Impact A local...

CVE-2019-15718

In systemd 240, busopensystemwatchbindwithdescription in shared/bus-util.c as used by systemd-resolved to connect to the system D-Bus instance, calls sdbussettrusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that...

Design/Logic Flaw

In systemd 240, busopensystemwatchbindwithdescription in shared/bus-util.c as used by systemd-resolved to connect to the system D-Bus instance, calls sdbussettrusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that...

CVE-2019-15718

CVE-2019-15718 affects systemd (notably systemd 240) where bus_open_system_watch_bind_with_description in shared/bus-util.c calls sd_bus_set_trusted, disabling access controls for incoming D-Bus messages. This allows an unprivileged user to invoke D-Bus methods that should be restricted, enabling...

CVE-2019-15718

In systemd 240, busopensystemwatchbindwithdescription in shared/bus-util.c as used by systemd-resolved to connect to the system D-Bus instance, calls sdbussettrusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that...

Ubuntu 18.04 LTS : systemd vulnerability (USN-4120-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4120-1 advisory. It was discovered that the systemd-resolved D-Bus interface did not enforce appropriate access controls. A local unprivileged user could exploit this to modify a...

CVE-2019-15718

In systemd 240, busopensystemwatchbindwithdescription in shared/bus-util.c as used by systemd-resolved to connect to the system D-Bus instance, calls sdbussettrusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that...

NewStart CGSL CORE 5.04 / MAIN 5.04 : flatpak Vulnerability (NS-SA-2019-0042)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has flatpak packages installed that are affected by a vulnerability: - It was found that flatpak's D-Bus proxy did not properly filter the access to D-Bus during the authentication protocol. A specially crafted flatpak...

Deepin Linux 15 - lastore-daemon Local Privilege Escalation Exploit

Exploit for multiple platform in category local exploits !/bin/bash Deepin Linux 15.5 lastore-daemon D-Bus Local Root Exploit The lastore-daemon D-Bus configuration on Deepin Linux 15.5 permits any user in the sudo group to install arbitrary packages without providing a password, resulting in cod...

Security Bulletin: Vyatta 5600 vRouter Software Patches - Release 1801-za

Summary AT&T has released versions 1801-za for the Vyatta 5600. Details of these releases can be found at https://cloud.ibm.com/docs/infrastructure/virtual-router-appliance?topic=virtual-router-appliance-at-t-vyatta-5600-vrouter-software-patchesat-t-vyatta-5600-vrouter-software-patches...

EulerOS 2.0 SP8 : gvfs (EulerOS-SA-2019-1768)

According to the version of the gvfs packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket witho...

EulerOS 2.0 SP2 : gvfs (EulerOS-SA-2019-1749)

According to the version of the gvfs packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket witho...

Updated gvfs packages fix security vulnerabilities

Updated gvfs package fixes security vulnerabilities: daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used CVE-2019-12447. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement queryinfoonread/write CVE-2019-12448...

MGASA-2019-0214 Updated gvfs packages fix security vulnerabilities

Updated gvfs package fixes security vulnerabilities: daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used CVE-2019-12447. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement queryinfoonread/write CVE-2019-12448...

SUSE SLED15 / SLES15 Security Update : systemd (SUSE-SU-2019:1364-2)

This update for systemd fixes the following issues : Security issues fixed : CVE-2019-3842: Fixed a privilege escalation in pamsystemd which could be exploited by a local user bsc1132348. CVE-2019-6454: Fixed a denial of service via crafted D-Bus message bsc1125352. CVE-2019-3843, CVE-2019-3844:...