Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.

NVD reports :

Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in user_change_icon_file_authorized_cb() in user.c.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4616-1 advisory.

    Kevin Backhouse discovered that AccountsService incorrectly dropped privileges. A local user could     possibly use this issue to cause AccountsService to crash or hang, resulting in a denial of service.
    (CVE-2020-16126)

    Kevin Backhouse discovered that AccountsService incorrectly handled reading .pam_environment files. A     local user could possibly use this issue to cause AccountsService to crash or hang, resulting in a denial     of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2020-16127)

    Matthias Gerstner discovered that AccountsService incorrectly handled certain path checks. A local     attacker could possibly use this issue to read arbitrary files. This issue only affected Ubuntu 16.04 LTS     and Ubuntu 18.04 LTS. (CVE-2018-14036)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the accountsservice packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Directory Traversal with ../ sequences occurs in     AccountsService before 0.6.50 because of an     insufficient path check in     user_change_icon_file_authorized_cb() in     user.c.(CVE-2018-14036)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for accountsservice fixes the following issues :

Security issue fixed :

CVE-2018-14036: Prevent directory traversal caused by an insufficient path check in user_change_icon_file_authorized_cb() (bsc#1099699).

Non-security issue fixed: Improved wtmp io performance (bsc#1139487).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for accountsservice fixes the following issues :

This security issue was fixed :

  - CVE-2018-14036: Prevent directory traversal caused by an     insufficient path check in     user_change_icon_file_authorized_cb() (bsc#1099699)

Thsese non-security issues were fixed :

  - Don't abort loading users when an /etc/shadow entry is     missing. (bsc#1090003)

  - When user session type is wayland, act_user_is_logged_in     can return TRUE if the user is logged in. (bsc#1095918)

This update was imported from the SUSE:SLE-15:Update update project.

This update for accountsservice fixes the following issues :

This security issue was fixed :

CVE-2018-14036: Prevent directory traversal caused by an insufficient path check in user_change_icon_file_authorized_cb() (bsc#1099699)

Thsese non-security issues were fixed: Don't abort loading users when an /etc/shadow entry is missing. (bsc#1090003)

When user session type is wayland, act_user_is_logged_in can return TRUE if the user is logged in. (bsc#1095918)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3140 advisory.

    GNOME is the default desktop environment of Red Hat Enterprise Linux.

    Security Fix(es):

    * libsoup: Crash in soup_cookie_jar.c:get_cookies() on empty hostnames (CVE-2018-12910)

    * poppler: Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function allows denial of     service (CVE-2017-18267)

    * libgxps: heap based buffer over read in ft_font_face_hash function of gxps-fonts.c (CVE-2018-10733)

    * libgxps: Stack-based buffer overflow in calling glib in gxps_images_guess_content_type of gcontenttype.c     (CVE-2018-10767)

    * poppler: NULL pointer dereference in Annot.h:AnnotPath::getCoordsLength() allows for denial of service     via crafted PDF (CVE-2018-10768)

    * poppler: out of bounds read in pdfunite (CVE-2018-13988)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank chenyuan (NESA Lab) for reporting CVE-2018-10733 and CVE-2018-10767 and Hosein     Askari for reporting CVE-2018-13988.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
148703	FreeBSD : AccountService -- Insufficient path check in user_change_icon_file_authorized_cb() (75aae50b-9e3c-11eb-9bc3-8c164582fbac)	Nessus	FreeBSD Local Security Checks	medium
142371	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : AccountsService vulnerabilities (USN-4616-1)	Nessus	Ubuntu Local Security Checks	medium
132376	EulerOS 2.0 SP5 : accountsservice (EulerOS-SA-2019-2709)	Nessus	Huawei Local Security Checks	medium
132272	EulerOS 2.0 SP3 : accountsservice (EulerOS-SA-2019-2555)	Nessus	Huawei Local Security Checks	medium
131597	EulerOS 2.0 SP2 : accountsservice (EulerOS-SA-2019-2443)	Nessus	Huawei Local Security Checks	medium
130256	SUSE SLED12 / SLES12 Security Update : accountsservice (SUSE-SU-2019:2778-1)	Nessus	SuSE Local Security Checks	medium
123368	openSUSE Security Update : accountsservice (openSUSE-2019-902)	Nessus	SuSE Local Security Checks	medium
120155	SUSE SLED15 / SLES15 Security Update : accountsservice (SUSE-SU-2018:3625-1)	Nessus	SuSE Local Security Checks	medium
118877	openSUSE Security Update : accountsservice (openSUSE-2018-1380)	Nessus	SuSE Local Security Checks	medium
118726	RHEL 7 : GNOME (RHSA-2018:3140)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2018-14036

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical