[ASA-201806-12] cantata: multiple issues

[Morten Linderud]

Arch Linux Security Advisory ASA-201806-12
==========================================

Severity: High
Date    : 2018-06-20
CVE-ID  : CVE-2018-12559 CVE-2018-12560 CVE-2018-12561 CVE-2018-12562
Package : cantata
Type    : multiple issues
Remote  : No
Link    : https://security.archlinux.org/AVG-721

Summary
=======

The package cantata before version 2.3.1-2 is vulnerable to multiple
issues including access restriction bypass and privilege escalation.

Resolution
==========

Upgrade to 2.3.1-2.

# pacman -Syu "cantata>=2.3.1-2"

The problems have been fixed upstream but no release is available yet.

Workaround
==========

None.

Description
===========

- CVE-2018-12559 (privilege escalation)

An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is
insufficient. A regular user can consequently mount a CIFS filesystem
anywhere (e.g., outside of the /home directory tree) by passing
directory traversal sequences such as a home/../usr substring.

- CVE-2018-12560 (access restriction bypass)

An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. Arbitrary unmounts can be performed by regular users via
directory traversal sequences such as a home/../sys/kernel substring.

- CVE-2018-12561 (access restriction bypass)

An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. A regular user can inject additional mount options such
as file_mode= by manipulating (for example) the domain parameter of the
samba URL.

- CVE-2018-12562 (access restriction bypass)

An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell
to forward the arguments to the actual mount.cifs binary. The shell
evaluates wildcards (such as in an injected string:/home/../tmp/*
string).

Impact
======

An unprivileged user is able to mount remote samba shares, enabling
arbitrary filesystem access and privileged escalation.

References
==========

http://www.openwall.com/lists/oss-security/2018/06/18/1	
https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3
http://www.openwall.com/lists/oss-security/2018/06/18/1
https://security.archlinux.org/CVE-2018-12559
https://security.archlinux.org/CVE-2018-12560
https://security.archlinux.org/CVE-2018-12561
https://security.archlinux.org/CVE-2018-12562
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20180626/41bdb494/attachment.asc>