oss-sec mailing list archives

Re: cantata: cantata-mounter D-Bus service local privilege escalation and other security issues

From: Matthias Gerstner <mgerstner () suse de>
Date: Tue, 19 Jun 2018 09:59:53 +0200

A) The mount target path check in mounter.cpp `mpOk()` is insufficient.
  A regular user can this way mount a CIFS filesystem anywhere, and not
  just beneath /home by passing relative path components.


This was assigned CVE-2018-12559.

B) Arbitrary unmounts can be performed by regular users the same way.


This was assigned CVE-2018-12560.

C) A regular user can inject additional mount options like file_mode= by
  manipulating e.g. the domain parameter of the samba URL.


This was assigned CVE-2018-12561.

D) The wrapper script 'mount.cifs.wrapper' uses the shell to forward the
  arguments to the actual mount.cifs binary. The shell evaluates
  wildcards which can also be injected like this:


This was assigned CVE-2018-12562.

Attachment: signature.asc
Description:

Current thread:

cantata: cantata-mounter D-Bus service local privilege escalation and other security issues Matthias Gerstner (Jun 18)
- Re: cantata: cantata-mounter D-Bus service local privilege escalation and other security issues Matthias Gerstner (Jun 19)