Security restrictions bypass in gvfs - CVE-2019-3827

Vulnerability identifier: #VU17775

CSH Severity: Low

CVSS v4: 7.5 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-3827

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to incorrect permission check in the admin backend. A local attacker can run malicious programs under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge.

gvfs
gvfs (Ubuntu package)
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for x86_64
Opensuse

Install updates from vendor's website.

gvfs (Ubuntu package) - addressed in versions 1.36.1-0ubuntu1.3, 1.38.1-0ubuntu1.2

• https://gitlab.gnome.org/GNOME/gvfs/issues/355

• Ubuntu update for GVfs
• OpenSUSE Linux update for gvfs
• Red Hat update for gvfs
• Red Hat update for gvfs