CVE Vulnerabilities

CVE-2018-13054

Improper Link Resolution Before File Access ('Link Following')

Published: Jul 02, 2018 | Modified: Sep 04, 2018
CVSS 3.x
8.1
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS 2.x
5.8 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu
HIGH

An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of (for example) other users icon files in _on_face_browse_menuitem_activated and _on_face_menuitem_activated. These icon files are written to the respective users $HOME/.face location. If an unprivileged user prepares a symlink pointing to an arbitrary location, then this location will be overwritten with the icon content.

Weakness

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Software

Name Vendor Start Version End Version
Debian_linux Debian 8.0 (including) 8.0 (including)
Cinnamon Ubuntu artful *
Cinnamon Ubuntu bionic *
Cinnamon Ubuntu cosmic *
Cinnamon Ubuntu esm-apps/bionic *
Cinnamon Ubuntu esm-apps/xenial *
Cinnamon Ubuntu upstream *
Cinnamon Ubuntu xenial *

Potential Mitigations

  • Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

References