Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 459276 (CVE-2013-1764) - <app-admin/packagekit-0.8.8: "update" allows downgrade of packages when using the "zypp" backend (CVE-2013-1764)
Summary: <app-admin/packagekit-0.8.8: "update" allows downgrade of packages when using...
Status: RESOLVED OBSOLETE
Alias: CVE-2013-1764
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: ~4 [glsa?]
Keywords:
Depends on:
Blocks:
 
Reported: 2013-02-26 09:49 UTC by Agostino Sarubbo
Modified: 2016-03-01 05:51 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-02-26 09:49:32 UTC
From ${URL} :

On openSUSE we have started to allow local logged in users to install
online updates (but not install new packages or remove ones), as this
seems a common and secure operation to us.
(Also done in light of the Linus Torvalds flame posting.)

PolicyKit rules in PackageKit also allow this in the vanilla version:
	org.freedesktop.packagekit.system-update
shipping default is "yes" for local logged-in active users.


So far we assumed that the update operation only allows upgrading versions.

The enforcement of this rule did not fully work, so at least the "zypp"
backend of PackageKit allowed downgrade of packages using this call.
The "update" method also allowed installing non-update resolvables like
patterns or even new packages.

We have not checked the other backends, they might also be affected.

https://bugzilla.novell.com/show_bug.cgi?id=804983
https://bugs.freedesktop.org/show_bug.cgi?id=61231
https://gitorious.org/packagekit/packagekit/commit/d3d14631042237bcfe6fb30a60e59bb6d94af425


As the default assumed secure behaviour is violated, this requires a CVE.
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2014-08-19 22:39:07 UTC
CVE-2013-1764 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1764):
  The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users
  to downgrade packages via the "install updates" method.
Comment 2 Gilles Dartiguelongue gentoo-dev 2016-01-03 13:41:11 UTC
While the zypp backend is not enabled in gentoo ebuilds, I must have a look at gentoo and entropy backends to make sure this does not happen there too.
Comment 3 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2016-02-21 11:00:29 UTC
>app-admin/packagekit-0.8.15 are in tree which mitigates this vulnerability.  Additional issues would warrant a new bug.
Comment 4 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2016-03-01 05:51:41 UTC
as previous mentioned this bug is obsolete now as all packages in tree are compliant.  GLSA Vote: No