Race condition in gvfs - CVE-2019-12448

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU18677

Race condition in gvfs - CVE-2019-12448

Published: June 5, 2019 / Updated: June 13, 2019


Vulnerability identifier: #VU18677
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2019-12448
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Gnome Development Team
Affected software:
gvfs

Detailed vulnerability description

The vulnerability allows a remote attacker to overwrite or access sensitive information, or cause a denial of service (DoS) condition on a targeted system.

The vulnerability exists due to race conditions in the daemon/gvfsbackendadmin.c source code file because the admin backend does not implement the query_info_on_read/write functionality. A remote attacker can send a request with malicious input to the system and cause race condition that will allow to overwrite or access sensitive information or cause a DoS condition.

How to mitigate CVE-2019-12448

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

As a temporary solution we recommend to install the software updates at the following link:


Sources