ubuntustudio-bugs team mailing list archive

[Simon Quigley <simon@xxxxxxxxxxxx>]

CVE-2018-6790
CVE-2018-6791

-- 
You received this bug notification because you are a member of Ubuntu
Studio Bugs, which is subscribed to kde-runtime in Ubuntu.
Matching subscriptions: Ubuntu Studio Bugs
https://bugs.launchpad.net/bugs/1748247

Title:
  [CVE] Arbitrary command execution in the removable device notifier

Status in kde-runtime package in Ubuntu:
  New
Status in plasma-workspace package in Ubuntu:
  Fix Released
Status in kde-runtime source package in Trusty:
  In Progress
Status in plasma-workspace source package in Trusty:
  In Progress
Status in kde-runtime source package in Xenial:
  In Progress
Status in plasma-workspace source package in Xenial:
  In Progress
Status in kde-runtime source package in Artful:
  In Progress
Status in plasma-workspace source package in Artful:
  In Progress
Status in kde-runtime source package in Bionic:
  New
Status in plasma-workspace source package in Bionic:
  Fix Released

Bug description:
  KDE Project Security Advisory
  =============================

  Title:          Plasma Desktop: Arbitrary command execution in the removable device notifier
  Risk Rating:    High
  CVE:            CVE-2018-6791
  Versions:       Plasma < 5.12.0
  Date:           8 February 2018

  
  Overview
  ========
  When a vfat thumbdrive which contains `` or $() in its volume label is plugged
  and mounted trough the device notifier, it's interpreted as a shell command,
  leaving a possibility of arbitrary commands execution. an example of offending
  volume label is "$(touch b)" which will create a file called b in the
  home folder.

  Workaround
  ==========
  Mount removable devices with Dolphin instead of the device notifier.

  Solution
  ========
  Update to Plasma >= 5.12.0 or Plasma >= 5.8.9

  Or apply the following patches:
  Plasma 5.8:
      https://commits.kde.org/plasma-workspace/9db872df82c258315c6ebad800af59e81ffb9212
  Plasma 5.9/5.10/5.11:
      https://commits.kde.org/plasma-workspace/f32002ce50edc3891f1fa41173132c820b917d57

  Credits
  =======
  Thanks to ksieluzyckih for the report and to Marco Martin for the fix.

  Patches for this bug should also contain fixes for CVE-2018-6790:

  KDE Project Security Advisory
  =============================

  Title:          Plasma: Notifications can expose user IP address
  Risk Rating:    Low
  CVE:            CVE-2018-6790
  Versions:       Plasma < 5.12.0
  Date:           8 February 2018

  
  Overview
  ========
  Plasma has support for the Desktop Nofications specification. That specification allows
  embedding images in notifications. Plasma was not sanitizing the HTML that forms the notification.
  That allowed for notifications to load a remote image leaking the user IP address. This is in turn
  made a bit worse by the fact that some chat software doesn't sanitize the text they send to the
  notification system either meaning that a third party could send a carefully crafted message
  to a chat room and get the IP addresses of the users in that chat room.

  Workaround
  ==========
  Disable notifications

  Solution
  ========
  Update to Plasma >= 5.12.0 or Plasma >= 5.8.9

  Or apply the following patches:
  Plasma 5.8: https://cgit.kde.org/plasma-workspace.git/commit/?h=Plasma/5.8&id=5bc696b5abcdb460c1017592e80b2d7f6ed3107c

  Credits
  =======
  Thanks to David Edmundson for the fix.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/kde-runtime/+bug/1748247/+subscriptions