In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

According to the version of the flatpak packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9,     and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus     messages to the host can be used to break out of the     sandbox, because whitespace handling in the proxy is     not identical to whitespace handling in the     daemon.(CVE-2018-6560)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has flatpak packages installed that are affected by a vulnerability:

  - It was found that flatpak's D-Bus proxy did not properly     filter the access to D-Bus during the authentication     protocol. A specially crafted flatpak application could     use this flaw to bypass all restrictions imposed by     flatpak and have full access to the D-BUS interface.
    (CVE-2018-6560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was found that flatpak's D-Bus proxy did not properly filter the access to D-Bus during the authentication protocol. A specially crafted flatpak application could use this flaw to bypass all restrictions imposed by flatpak and have full access to the D-BUS interface.(CVE-2018-6560)

An update for flatpak is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es) :

* flatpak: sandbox escape in D-Bus filtering by a crafted authentication handshake (CVE-2018-6560)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Security Fix(es) :

  - flatpak: sandbox escape in D-Bus filtering by a crafted     authentication handshake (CVE-2018-6560)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-2766 advisory.

    [0.8.8-4]
    - Add patch for CVE-2018-6560 (#1547376)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for flatpak to version 0.8.9 fixes security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2018-6560: sandbox escape in the flatpak dbus proxy     (boo#1078923)

  - CVE-2017-9780: Malicious apps could have included     inappropriate permissions (boo#1078989)

  - old-style eavesdropping in the dbus proxy (boo#1078993)

This update also includes all upstream improvements and fixes in this stable release series.

ID	Name	Product	Family	Severity
130855	EulerOS 2.0 SP5 : flatpak (EulerOS-SA-2019-2146)	Nessus	Huawei Local Security Checks	high
127218	NewStart CGSL CORE 5.04 / MAIN 5.04 : flatpak Vulnerability (NS-SA-2019-0042)	Nessus	NewStart CGSL Local Security Checks	high
118403	Amazon Linux 2 : flatpak (ALAS-2018-1096)	Nessus	Amazon Linux Local Security Checks	high
117831	CentOS 7 : flatpak (CESA-2018:2766)	Nessus	CentOS Local Security Checks	high
117786	Scientific Linux Security Update : flatpak on SL7.x x86_64 (20180925)	Nessus	Scientific Linux Local Security Checks	high
117777	RHEL 7 : flatpak (RHSA-2018:2766)	Nessus	Red Hat Local Security Checks	high
117767	Oracle Linux 7 : flatpak (ELSA-2018-2766)	Nessus	Oracle Linux Local Security Checks	high
106663	openSUSE Security Update : flatpak (openSUSE-2018-139)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-6560

high

Tenable Plugins

high

high

high

high

high

high

high

high