Stay Secure with the Latest Linux Advisories

security advisorysecurity updateaccess control

Mageia 2019-0080 Critical Security Advisory for gvfs Access Control

The backend currently allows to access and modify files without prompting for password if any polkit authentication agent isn't available. This affects only users which belong to wheel group (i.e. those who are already allowed to use sudo). It doesn't allow privilege escalation for users, who don't belong to that group (CVE-2019-3827). . MGASA-2019-0080 - Updated gvfs packages fix security vulnerability Publication date: 14 Feb 2019 URL: https://advisories.mageia.org/MGASA-2019-0080.html Type: security Affected Mageia releases: 6 CVE: CVE-2019-3827 The backend currently allows to access and modify files without prompting for password if any polkit authentication agent isn't available. This affects only users which belong to wheel group (i.e. those who are already allowed to use sudo). It doesn't allow privilege escalation for users, who don't belong to that group (CVE-2019-3827). References: - https://bugs.mageia.org/show_bug.cgi?id=24215 - https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./thread/Y43CRGATQPYWH2UXO6ZS7PYPCSZGTGED/ - https://ubuntu.com/security/notices/USN-3888-1 - https://www.cve.org/CVERecord?id=CVE-2019-3827 SRPMS: - 6/core/gvfs-1.32.1-1.1.mga6 . MGASA-2019-0080 - Updated gvfs packages fix security vulnerability Publication date: 14 Feb 2019 URL. backend, currently, allows, modify, files, without, prompting, password, polkit. . Severity: Critical. LinuxSecurity.com Team

Feb 14, 2019 •Critical Mageia