An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of (for example) other users' icon files in _on_face_browse_menuitem_activated and _on_face_menuitem_activated. These icon files are written to the respective user's $HOME/.face location. If an unprivileged user prepares a symlink pointing to an arbitrary location, then this location will be overwritten with the icon content.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-4844-1 advisory.

    Matthias Gerstner discovered that the cinnamon-settings-users utility in Cinnamon did not safely handle     symlinks. An unprivileged attacker could potentially use this vulnerability to overwrite arbitrary files     as root.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for cinnamon fixes the following issues :

Security issue fixed :

  - CVE-2018-13054: Fix symlink attack vulnerability     (boo#1083067).

Fix CVE-2018-13054 cinnamon: privilege escalation in cinnamon-settings-users.py GUI

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for cinnamon fixes the following issues :

Security issue fixed :

  - CVE-2018-13054: Fix symlink attack vulnerability     (boo#1083067).

Bug fixes :

  - Update to version 3.4.6 (changes since 3.4.4) :

  - osdWindow.js: Always check the theme node on first     showing - an actor's width isn't necessarily filled if     it hasn't been explicitly set, causing the first few     activations of the OSD to not show an accurate level     bar.

  - cs_default: Fix an incorrect button label (but preserve     translations).

  - main.js: Remove an obsolete Meta enum member reference.

  - workspace.js: Use our normal prototype init method.

  - workspace.js: Initalise WindowClone._zoomStep to 0.

  - slideshow-applet: Fix a translation.

  - cs_themes.py: Create the file     '~/.icons/default/index.theme' and set the selected     cursor theme inside of it. This ensures other (non-gtk)     applications end up using the same theme (though they     are required to be restarted for these changes to take     effect).

  - keyboard-applet: Applet icon vanishes when moved in edit     mode.

  - cinnamon-json-makepot: Add keyword option, change     language used by xgettext to JavaScript.

  - expoThumbnail: Correct a couple of calls with mismatched     argument counts.

  - window-list: Set AppMenuButtons unreactive during panel     edit mode.

  - panel-launchers: Set PanelAppLaunchers unreactive during     panel edit mode.

  - windows-quick-list: Fix argument warning.

  - Fix a reference to undefined actor._delegate warning.

  - ui/environment: Handle undefined actors in     containerClass.prototype.add.

  - ui/cinnamonDBus: Handle null xlet objects in     CinnamonDBus.highlightXlet.

  - deskletManager: Initialise some variables and remove the     variables that were initialised, probable typo

It was discovered that there was a symlink attack in the Cinnamon desktop environment.

An attacker could overwrite an arbitrary file on the filesystem via a $HOME/.face icon file (as the cinnamon-settings-users.py GUI runs as root).

For Debian 8 'Jessie', this issue has been fixed in cinnamon version 2.2.16-5+deb8u1.

We recommend that you upgrade your cinnamon packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183604	Ubuntu 16.04 ESM / 18.04 ESM : Cinnamon vulnerability (USN-4844-1)	Nessus	Ubuntu Local Security Checks	high
123225	openSUSE Security Update : cinnamon (openSUSE-2019-534)	Nessus	SuSE Local Security Checks	high
120781	Fedora 28 : cinnamon (2018-c785c43a8f)	Nessus	Fedora Local Security Checks	high
111420	openSUSE Security Update : cinnamon (openSUSE-2018-768)	Nessus	SuSE Local Security Checks	high
111419	openSUSE Security Update : cinnamon (openSUSE-2018-767)	Nessus	SuSE Local Security Checks	high
111242	Fedora 27 : cinnamon (2018-64af4d2108)	Nessus	Fedora Local Security Checks	high
111080	Debian DLA-1420-1 : cinnamon security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-13054

high

Tenable Plugins

high

high

high

high

high

high

high