Описание
It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask policy. This only affects xdg-user-dirs before 0.15.5 as shipped with Red Hat Enterprise Linux.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| xdg-user-dirs | unfixed | package |
Примечания
The CVE relates that created directories by xdg-user-dirs might not
respect a system policy for user created files by setting a umask
system-wide in e.g. /etc/profile due to xdg-user-dirs beeing invoked
from Xsession scripts. This can be mitigated by e.g. using pam_umask
on session start and having it when xdg-user-dirs is executed.
In Debian xdg-user-dirs starting from 0.15-3 replaces the use of
/etc/X11/Xsession.d/*xdg-user-dirs-update with an autostart .desktop
file for user-dirs-update primarly to work as well with Wayland
sessions.
Enforcements can be achieved e.g. by using pam_umask.
http://bugs.freedesktop.org/show_bug.cgi?id=102303
Связанные уязвимости
It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask policy. This only affects xdg-user-dirs before 0.15.5 as shipped with Red Hat Enterprise Linux.
It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask policy. This only affects xdg-user-dirs before 0.15.5 as shipped with Red Hat Enterprise Linux.
It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask policy. This only affects xdg-user-dirs before 0.15.5 as shipped with Red Hat Enterprise Linux.
It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask policy. This only affects xdg-user-dirs before 0.15.5 as shipped with Red Hat Enterprise Linux.
ELSA-2018-0842: xdg-user-dirs security and bug fix update (LOW)