An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.

According to the version of the PackageKit packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An authentication bypass flaw has been found in     PackageKit before 1.1.10 that allows users without     administrator privileges to install signed packages. A     local attacker can use this vulnerability to install     vulnerable packages to further compromise a     system.(CVE-2018-1106)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has PackageKit packages installed that are affected by a vulnerability:

  - An authentication bypass flaw has been found in     PackageKit that allows users without administrator     privileges to install signed packages. A local attacker     can use this vulnerability to install vulnerable     packages to further compromise a system. (CVE-2018-1106)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New upstream release

  - This release fixes CVE-2018-1106 which is a moderate     security issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for PackageKit is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API.

Security Fix(es) :

* PackageKit: authentication bypass allows to install signed packages without administrator privileges (CVE-2018-1106)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Matthias Gerstner (SUSE) for reporting this issue.

Matthias Gerstner discovered that PackageKit, a DBus abstraction layer for simple software management tasks, contains an authentication bypass flaw allowing users without privileges to install local packages.

Security Fix(es) :

  - PackageKit: authentication bypass allows to install     signed packages without administrator privileges     (CVE-2018-1106)

New upstream release - This release fixes CVE-2018-1106 which is a moderate security issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Authentication bypass allows to install signed packages without administrator privileges

An authentication bypass flaw has been found in PackageKit that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system. (CVE-2018-1106)

Matthias Gerstner discovered that PackageKit incorrectly handled authentication. A local attacker could possibly use this issue to install arbitrary packages and escalate privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1224 advisory.

  - PackageKit: authentication bypass allows to install signed packages without administrator privileges     (CVE-2018-1106)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2018:1224 :

An update for PackageKit is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API.

Security Fix(es) :

* PackageKit: authentication bypass allows to install signed packages without administrator privileges (CVE-2018-1106)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Matthias Gerstner (SUSE) for reporting this issue.

- CVE-2018-1106: Drop the polkit rule which could allow     users in wheel group to install packages without root     password (bsc#1086936).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for PackageKit fixes the following security issue :

  - CVE-2018-1106: Drop the polkit rule which could allow     users in wheel group to install packages without root     password (bsc#1086936). This update was imported from     the SUSE:SLE-12-SP2:Update update project.

ID	Name	Product	Family	Severity
132367	EulerOS 2.0 SP5 : PackageKit (EulerOS-SA-2019-2700)	Nessus	Huawei Local Security Checks	medium
127191	NewStart CGSL CORE 5.04 / MAIN 5.04 : PackageKit Vulnerability (NS-SA-2019-0028)	Nessus	NewStart CGSL Local Security Checks	medium
120690	Fedora 28 : PackageKit (2018-a86100a264)	Nessus	Fedora Local Security Checks	medium
110847	EulerOS 2.0 SP3 : PackageKit (EulerOS-SA-2018-1183)	Nessus	Huawei Local Security Checks	medium
110243	CentOS 7 : PackageKit (CESA-2018:1224)	Nessus	CentOS Local Security Checks	medium
110152	EulerOS 2.0 SP2 : PackageKit (EulerOS-SA-2018-1148)	Nessus	Huawei Local Security Checks	medium
109968	Debian DSA-4207-1 : packagekit - security update	Nessus	Debian Local Security Checks	medium
109463	Scientific Linux Security Update : PackageKit on SL7.x x86_64 (20180424)	Nessus	Scientific Linux Local Security Checks	medium
109435	Fedora 27 : PackageKit (2018-a3b7c7eb79)	Nessus	Fedora Local Security Checks	medium
109366	Amazon Linux 2 : PackageKit (ALAS-2018-1006)	Nessus	Amazon Linux Local Security Checks	medium
109343	Ubuntu 17.10 : PackageKit vulnerability (USN-3634-1)	Nessus	Ubuntu Local Security Checks	medium
109338	RHEL 7 : PackageKit (RHSA-2018:1224)	Nessus	Red Hat Local Security Checks	medium
109332	Oracle Linux 7 : PackageKit (ELSA-2018-1224)	Nessus	Oracle Linux Local Security Checks	medium
109309	SUSE SLED12 / SLES12 Security Update : PackageKit (SUSE-SU-2018:1047-1)	Nessus	SuSE Local Security Checks	medium
109291	openSUSE Security Update : PackageKit (openSUSE-2018-386)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2018-1106

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium