CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
61.0%
Severity: High
Date : 2018-06-20
CVE-ID : CVE-2018-12559 CVE-2018-12560 CVE-2018-12561 CVE-2018-12562
Package : cantata
Type : multiple issues
Remote : No
Link : https://security.archlinux.org/AVG-721
The package cantata before version 2.3.1-2 is vulnerable to multiple
issues including access restriction bypass and privilege escalation.
Upgrade to 2.3.1-2.
The problems have been fixed upstream but no release is available yet.
None.
An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. The mount target path check in mounter.cpp mpOk()
is
insufficient. A regular user can consequently mount a CIFS filesystem
anywhere (e.g., outside of the /home directory tree) by passing
directory traversal sequences such as a home/…/usr substring.
An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. Arbitrary unmounts can be performed by regular users via
directory traversal sequences such as a home/…/sys/kernel substring.
An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. A regular user can inject additional mount options such
as file_mode= by manipulating (for example) the domain parameter of the
samba URL.
An issue was discovered in the cantata-mounter D-Bus service in Cantata
through 2.3.1. The wrapper script ‘mount.cifs.wrapper’ uses the shell
to forward the arguments to the actual mount.cifs binary. The shell
evaluates wildcards (such as in an injected string:/home/…/tmp/*
string).
An unprivileged user is able to mount remote samba shares, enabling
arbitrary filesystem access and privileged escalation.
http://www.openwall.com/lists/oss-security/2018/06/18/1
https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3
http://www.openwall.com/lists/oss-security/2018/06/18/1
https://security.archlinux.org/CVE-2018-12559
https://security.archlinux.org/CVE-2018-12560
https://security.archlinux.org/CVE-2018-12561
https://security.archlinux.org/CVE-2018-12562
www.openwall.com/lists/oss-security/2018/06/18/1
www.openwall.com/lists/oss-security/2018/06/18/1
github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3
security.archlinux.org/AVG-721
security.archlinux.org/CVE-2018-12559
security.archlinux.org/CVE-2018-12560
security.archlinux.org/CVE-2018-12561
security.archlinux.org/CVE-2018-12562
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
61.0%