CVE-2019-12449

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to file:// URIs, because root privileges are unavailable.

GNOME is the default desktop environment of Rocky Linux.

Security Fix(es):

• LibRaw: stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp (CVE-2018-20337)

• gdm: lock screen bypass when timed login is enabled (CVE-2019-3825)

• gvfs: mishandling of file ownership in daemon/gvfsbackendadmin.c (CVE-2019-12447)

• gvfs: race condition in daemon/gvfsbackendadmin.c due to admin backend not implementing query_info_on_read/write (CVE-2019-12448)

• gvfs: mishandling of file's user and group ownership in daemon/gvfsbackendadmin.c due to unavailability of root privileges (CVE-2019-12449)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to file:// URIs, because root privileges are unavailable.

GNOME is the default desktop environment of AlmaLinux.

Security Fix(es):

• LibRaw: stack-based buffer overflow in the parse_makernote function of dcraw_common.cpp (CVE-2018-20337)

• gdm: lock screen bypass when timed login is enabled (CVE-2019-3825)

• gvfs: mishandling of file ownership in daemon/gvfsbackendadmin.c (CVE-2019-12447)

• gvfs: race condition in daemon/gvfsbackendadmin.c due to admin backend not implementing query_info_on_read/write (CVE-2019-12448)

• gvfs: mishandling of file's user and group ownership in daemon/gvfsbackendadmin.c due to unavailability of root privileges (CVE-2019-12449)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Updated gvfs package fixes security vulnerabilities:

• daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used (CVE-2019-12447).
• daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement query_info_on_read/write (CVE-2019-12448).
• daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to file:// URIs, because root privileges are unavailable (CVE-2019-12449).
• daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule (CVE-2019-12795)

This update for gvfs fixes the following issues:

Security issues fixed:

• CVE-2019-12795: Fixed a vulnerability which could have allowed attacks via local D-Bus method calls (bsc#1137930).
• CVE-2019-12447: Fixed an improper handling of file ownership in daemon/gvfsbackendadmin.c due to no use of setfsuid (bsc#1136986).
• CVE-2019-12449: Fixed an improper handling of file's user and group ownership
  in daemon/gvfsbackendadmin.c (bsc#1136992).
• CVE-2019-12448: Fixed race conditions in daemon/gvfsbackendadmin.c due to implementation of query_info_on_read/write at admin backend (bsc#1136981).

Other issue addressed:

• Drop polkit rules files that are only relevant for wheel group (bsc#1125433).

This update was imported from the SUSE:SLE-15:Update update project.

This update for gvfs fixes the following issues:

Security issues fixed:

• CVE-2019-12795: Fixed a vulnerability which could have allowed attacks via local D-Bus method calls (bsc#1137930).
• CVE-2019-12447: Fixed an improper handling of file ownership in daemon/gvfsbackendadmin.c due to no use of setfsuid (bsc#1136986).
• CVE-2019-12449: Fixed an improper handling of file's user and group ownership
  in daemon/gvfsbackendadmin.c (bsc#1136992).
• CVE-2019-12448: Fixed race conditions in daemon/gvfsbackendadmin.c due to implementation of query_info_on_read/write at admin backend (bsc#1136981).

Other issue addressed:

• Drop polkit rules files that are only relevant for wheel group (bsc#1125433).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the gvfs-1.48.1-1.3 package on the GA media of openSUSE Tumbleweed.

This update for gvfs fixes the following issues:

Security issues fixed:

• CVE-2019-12795: Fixed a vulnerability which could have allowed attacks via local D-Bus method calls (bsc#1137930).
• CVE-2019-12447: Fixed an improper handling of file ownership in daemon/gvfsbackendadmin.c due to no use of setfsuid (bsc#1136986).
• CVE-2019-12449: Fixed an improper handling of file's user and group ownership
  in daemon/gvfsbackendadmin.c (bsc#1136992).
• CVE-2019-12448: Fixed race conditions in daemon/gvfsbackendadmin.c due to implementation of query_info_on_read/write at admin backend (bsc#1136981).

Other issue addressed:

• Drop polkit rules files that are only relevant for wheel group (bsc#1125433).

It was discovered that GVfs incorrectly handled the admin backend. Files created or moved by the admin backend could end up with the wrong ownership information, contrary to expectations. This issue only affected Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04. (CVE-2019-12447, CVE-2019-12448, CVE-2019-12449)

It was discovered that GVfs incorrectly handled authentication on its private D-Bus socket. A local attacker could possibly connect to this socket and issue D-Bus calls. (CVE-2019-12795)