ArchLinux: 201806-12: cantata: multiple issues
Summary
- CVE-2018-12559 (privilege escalation)
An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is
insufficient. A regular user can consequently mount a CIFS filesystem
anywhere (e.g., outside of the /home directory tree) by passing
directory traversal sequences such as a home/../usr substring.
- CVE-2018-12560 (access restriction bypass)
An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. Arbitrary unmounts can be performed by regular users via
directory traversal sequences such as a home/../sys/kernel substring.
- CVE-2018-12561 (access restriction bypass)
An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. A regular user can inject additional mount options such
as file_mode= by manipulating (for example) the domain parameter of the
samba URL.
- CVE-2018-12562 (access restriction bypass)
An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell
to forward the arguments to the actual mount.cifs binary. The shell
evaluates wildcards (such as in an injected string:/home/../tmp/*
string).
Resolution
Upgrade to 2.3.1-2.
# pacman -Syu "cantata>=2.3.1-2"
The problems have been fixed upstream but no release is available yet.
References
https://www.openwall.com/lists/oss-security/2018/06/18/1 https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3 https://www.openwall.com/lists/oss-security/2018/06/18/1 https://security.archlinux.org/CVE-2018-12559 https://security.archlinux.org/CVE-2018-12560 https://security.archlinux.org/CVE-2018-12561 https://security.archlinux.org/CVE-2018-12562
![Dist Arch](/images/distros/dist-arch.png)
Workaround
None.