group.of.nepali.translators team mailing list archive

[Simon Quigley <simon@xxxxxxxxxxxx>]

*** This bug is a security vulnerability ***

Public security bug reported:

KDE Project Security Advisory
=============================

Title:          Plasma Desktop: Arbitrary command execution in the removable device notifier
Risk Rating:    High
CVE:            CVE-2018-6791
Versions:       Plasma < 5.12.0
Date:           8 February 2018


Overview
========
When a vfat thumbdrive which contains `` or $() in its volume label is plugged
and mounted trough the device notifier, it's interpreted as a shell command,
leaving a possibility of arbitrary commands execution. an example of offending
volume label is "$(touch b)" which will create a file called b in the
home folder.

Workaround
==========
Mount removable devices with Dolphin instead of the device notifier.

Solution
========
Update to Plasma >= 5.12.0 or Plasma >= 5.8.9

Or apply the following patches:
Plasma 5.8:
    https://commits.kde.org/plasma-workspace/9db872df82c258315c6ebad800af59e81ffb9212
Plasma 5.9/5.10/5.11:
    https://commits.kde.org/plasma-workspace/f32002ce50edc3891f1fa41173132c820b917d57

Credits
=======
Thanks to ksieluzyckih for the report and to Marco Martin for the fix.

Patches for this bug should also contain fixes for CVE-2018-6790:

KDE Project Security Advisory
=============================

Title:          Plasma: Notifications can expose user IP address
Risk Rating:    Low
CVE:            CVE-2018-6790
Versions:       Plasma < 5.12.0
Date:           8 February 2018


Overview
========
Plasma has support for the Desktop Nofications specification. That specification allows
embedding images in notifications. Plasma was not sanitizing the HTML that forms the notification.
That allowed for notifications to load a remote image leaking the user IP address. This is in turn
made a bit worse by the fact that some chat software doesn't sanitize the text they send to the
notification system either meaning that a third party could send a carefully crafted message
to a chat room and get the IP addresses of the users in that chat room.

Workaround
==========
Disable notifications

Solution
========
Update to Plasma >= 5.12.0 or Plasma >= 5.8.9

Or apply the following patches:
Plasma 5.8: https://cgit.kde.org/plasma-workspace.git/commit/?h=Plasma/5.8&id=5bc696b5abcdb460c1017592e80b2d7f6ed3107c

Credits
=======
Thanks to David Edmundson for the fix.

** Affects: kde-runtime (Ubuntu)
     Importance: High
     Assignee: Rik Mills (rikmills)
         Status: New

** Affects: plasma-workspace (Ubuntu)
     Importance: High
     Assignee: Rik Mills (rikmills)
         Status: Fix Released

** Affects: kde-runtime (Ubuntu Trusty)
     Importance: High
     Assignee: Simon Quigley (tsimonq2)
         Status: In Progress

** Affects: plasma-workspace (Ubuntu Trusty)
     Importance: High
     Assignee: Simon Quigley (tsimonq2)
         Status: In Progress

** Affects: kde-runtime (Ubuntu Xenial)
     Importance: High
     Assignee: Simon Quigley (tsimonq2)
         Status: In Progress

** Affects: plasma-workspace (Ubuntu Xenial)
     Importance: High
     Assignee: Simon Quigley (tsimonq2)
         Status: In Progress

** Affects: kde-runtime (Ubuntu Artful)
     Importance: High
     Assignee: Simon Quigley (tsimonq2)
         Status: In Progress

** Affects: plasma-workspace (Ubuntu Artful)
     Importance: High
     Assignee: Simon Quigley (tsimonq2)
         Status: In Progress

** Affects: kde-runtime (Ubuntu Bionic)
     Importance: High
     Assignee: Rik Mills (rikmills)
         Status: New

** Affects: plasma-workspace (Ubuntu Bionic)
     Importance: High
     Assignee: Rik Mills (rikmills)
         Status: Fix Released

** Also affects: plasma-workspace (Ubuntu Xenial)
   Importance: Undecided
       Status: New

** Also affects: plasma-workspace (Ubuntu Trusty)
   Importance: Undecided
       Status: New

** Also affects: plasma-workspace (Ubuntu Bionic)
   Importance: Undecided
       Status: New

** Also affects: plasma-workspace (Ubuntu Artful)
   Importance: Undecided
       Status: New

** Also affects: kde-runtime (Ubuntu)
   Importance: Undecided
       Status: New

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1748247

Title:
  [CVE] Arbitrary command execution in the removable device notifier

Status in kde-runtime package in Ubuntu:
  New
Status in plasma-workspace package in Ubuntu:
  Fix Released
Status in kde-runtime source package in Trusty:
  In Progress
Status in plasma-workspace source package in Trusty:
  In Progress
Status in kde-runtime source package in Xenial:
  In Progress
Status in plasma-workspace source package in Xenial:
  In Progress
Status in kde-runtime source package in Artful:
  In Progress
Status in plasma-workspace source package in Artful:
  In Progress
Status in kde-runtime source package in Bionic:
  New
Status in plasma-workspace source package in Bionic:
  Fix Released

Bug description:
  KDE Project Security Advisory
  =============================

  Title:          Plasma Desktop: Arbitrary command execution in the removable device notifier
  Risk Rating:    High
  CVE:            CVE-2018-6791
  Versions:       Plasma < 5.12.0
  Date:           8 February 2018

  
  Overview
  ========
  When a vfat thumbdrive which contains `` or $() in its volume label is plugged
  and mounted trough the device notifier, it's interpreted as a shell command,
  leaving a possibility of arbitrary commands execution. an example of offending
  volume label is "$(touch b)" which will create a file called b in the
  home folder.

  Workaround
  ==========
  Mount removable devices with Dolphin instead of the device notifier.

  Solution
  ========
  Update to Plasma >= 5.12.0 or Plasma >= 5.8.9

  Or apply the following patches:
  Plasma 5.8:
      https://commits.kde.org/plasma-workspace/9db872df82c258315c6ebad800af59e81ffb9212
  Plasma 5.9/5.10/5.11:
      https://commits.kde.org/plasma-workspace/f32002ce50edc3891f1fa41173132c820b917d57

  Credits
  =======
  Thanks to ksieluzyckih for the report and to Marco Martin for the fix.

  Patches for this bug should also contain fixes for CVE-2018-6790:

  KDE Project Security Advisory
  =============================

  Title:          Plasma: Notifications can expose user IP address
  Risk Rating:    Low
  CVE:            CVE-2018-6790
  Versions:       Plasma < 5.12.0
  Date:           8 February 2018

  
  Overview
  ========
  Plasma has support for the Desktop Nofications specification. That specification allows
  embedding images in notifications. Plasma was not sanitizing the HTML that forms the notification.
  That allowed for notifications to load a remote image leaking the user IP address. This is in turn
  made a bit worse by the fact that some chat software doesn't sanitize the text they send to the
  notification system either meaning that a third party could send a carefully crafted message
  to a chat room and get the IP addresses of the users in that chat room.

  Workaround
  ==========
  Disable notifications

  Solution
  ========
  Update to Plasma >= 5.12.0 or Plasma >= 5.8.9

  Or apply the following patches:
  Plasma 5.8: https://cgit.kde.org/plasma-workspace.git/commit/?h=Plasma/5.8&id=5bc696b5abcdb460c1017592e80b2d7f6ed3107c

  Credits
  =======
  Thanks to David Edmundson for the fix.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/kde-runtime/+bug/1748247/+subscriptions