Home | Devuan | Git | Forum | Packages | Popcon
Donate now!
Download

Devuan bug report logs - #268
policykit-1: CVE-2018-19788

Package: policykit-1; Maintainer for policykit-1 is Devuan Dev Team <devuan-dev@lists.dyne.org>; Source for policykit-1 is src:policykit-1.

Reported by: Berbe <bernard+devuan@rosset.net>

Date: Fri, 7 Dec 2018 17:48:01 UTC

Severity: critical

Merged with 269

Done: KatolaZ <katolaz@freaknet.org>

Full log

🔗 View this message in rfc822 format

X-Loop: owner@bugs.devuan.org
Subject: bug#268: policykit-1: CVE-2018-19788
Reply-To: Berbe <bernard+devuan@rosset.net>, 268@bugs.devuan.org
Resent-From: Berbe <bernard+devuan@rosset.net>
Resent-To: devuan-bugs@lists.dyne.org
Resent-CC: owner@bugs.devuan.org
Resent-Date: Fri, 07 Dec 2018 17:48:01 UTC
Resent-Message-ID: <handler.268.B.154420463918042@bugs.devuan.org>
Resent-Sender: owner@bugs.devuan.org
X-Devuan-PR-Message: report 268
X-Devuan-PR-Package: policykit-1
X-Devuan-PR-Keywords: 
Received: via spool by submit@bugs.devuan.org id=B.154420463918042
          (code B ref -1); Fri, 07 Dec 2018 17:48:01 UTC
Received: (at submit) by bugs.devuan.org; 7 Dec 2018 17:43:59 +0000
Delivered-To: devuanbugs@dyne.org
Received: from tupac3.dyne.org [195.169.149.119]
	by fulcanelli with IMAP (fetchmail-6.3.26)
	for <debbugs@localhost> (single-drop); Fri, 07 Dec 2018 18:43:59 +0100 (CET)
Received: from mail.rosset.net (rosset.net [62.210.209.186])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by vm6.ganeti.dyne.org (Postfix) with ESMTPS id 2837BF6093F
	for <submit@bugs.devuan.org>; Fri,  7 Dec 2018 18:41:09 +0100 (CET)
Authentication-Results: vm6.ganeti.dyne.org;
	dkim=pass (1024-bit key; unprotected) header.d=rosset.net header.i=@rosset.net header.b="w5T9rg5y";
	dkim-atps=neutral
Received: by mail.rosset.net (Postfix, from userid 1000)
	id B6C2DE0279; Fri,  7 Dec 2018 18:41:08 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=rosset.net;
	s=NetNeutrality; t=1544204468;
	bh=Qh2OhVEyGD+yxbVNHnJqf32+SUjphhhTnfoF6byME0E=;
	h=From:To:Subject:Date:From;
	b=w5T9rg5yEFFmx2XrRekDJMB5hWOh0kIZ+nl9pbmupwIQUADrvIi8UC89aIoPBszD8
	 eWnzJ2b9V28vdVkkkUIbSN7VeYZgk9xniNPjD3j8PK70OzZrNmrXY68Us0jA/EZD/C
	 Jl5dGa4OJeWOZXdCcEwz6kAMLdKLRF65W3A7sgQA=
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Berbe <bernard+devuan@rosset.net>
To: Devuan Bug Tracking System <submit@bugs.devuan.org>
Message-ID: <154420446865.5084.8077177848613701893.reportbug@sd-49041.dedibox.fr>
X-Mailer: reportbug 7.1.6+devuan2.1
Date: Fri, 07 Dec 2018 18:41:08 +0100
X-Spam-Status: No, score=-0.2 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,DKIM_VALID_EF,SPF_PASS autolearn=disabled version=3.4.2
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on tupac3.dyne.org

Package: policykit-1
Version: 0.105-18+devuan2.11
Severity: critical

Dear Maintainer,

Following CVE-2018-19788, it seems the current stable 0.105-18+devuan2.11 is susceptible to the bug in policykit-1 package from upstream, allowing any user with UID > INT_MAX to have access to root commands:

1. service nginx status
-bash: service: command not found
2. sudo useradd -u 4000000000 test
3. sudo -u test service nginx status
nginx is running.


-- System Information:
Distributor ID:	Devuan
Description:	Devuan GNU/Linux 9 (n/a)
Release:	9
Codename:	n/a

Architecture: x86_64

Kernel: Linux 4.9.0-8-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages policykit-1 depends on:
ii  dbus                   1.10.26-0+deb9u1
ii  libc6                  2.24-11+deb9u3
ii  libglib2.0-0           2.50.3-2
ii  libpam0g               1.1.8-3.6
ii  libpolkit-agent-1-0    0.105-18+devuan2.11
ii  libpolkit-backend-1-0  0.105-18+devuan2.11
ii  libpolkit-gobject-1-0  0.105-18+devuan2.11

policykit-1 recommends no packages.

policykit-1 suggests no packages.

-- no debconf information

Send a report that this bug log contains spam.

Devuan BTS -- Powered by Debian bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.

Devuan Bugs Owner <owner@bugs.devuan.org>.
Last modified: Wed Dec 17 12:32:25 2025;