Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 624980 (CVE-2017-7358, CVE-2017-8900) - x11-misc/lightdm: Privilege escalation vulnerabilities
Summary: x11-misc/lightdm: Privilege escalation vulnerabilities
Status: RESOLVED OBSOLETE
Alias: CVE-2017-7358, CVE-2017-8900
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-07-14 12:05 UTC by Andrey Ovcharov
Modified: 2019-03-28 18:51 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andrey Ovcharov 2017-07-14 12:05:15 UTC
https://nvd.nist.gov/vuln/detail/CVE-2017-7358

"In LightDM through 1.22.0, a directory traversal issue in debian/guest-account.sh allows local attackers to own arbitrary directory path locations and escalate privileges to root when the guest user logs out."

https://nvd.nist.gov/vuln/detail/CVE-2017-8900

"LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass intended AppArmor restrictions and visit the home directories of arbitrary users by establishing a guest session."
Comment 1 Kristian Fiskerstrand (RETIRED) gentoo-dev 2017-07-14 13:20:23 UTC
I suspect we don't install either guest-account.sh (from debian specific directory) nor have the AppArmor restrictions in place that CVE-2017-8900 bypasses, but will leave bug open in case maintainers have comments.
Comment 2 Kristian Fiskerstrand (RETIRED) gentoo-dev 2017-07-14 13:31:33 UTC
https://www.ubuntu.com/usn/usn-3285-1/:
Details

Tyler Hicks discovered that LightDM did not confine the user session for guest
users. An attacker with physical access could use this issue to access files
and other resources that they should not be able to access. In the default
installation, this includes files in the home directories of other users on the
system. This update fixes the issue by disabling the guest session. It may be
re-enabled in a future update. Please see the bug referenced below for
instructions on how to manually re-enable the guest session.
Comment 3 Yury German Gentoo Infrastructure gentoo-dev 2019-03-11 03:22:44 UTC
Following up, is this still valid?
Comment 4 Lars Wendler (Polynomial-C) gentoo-dev 2019-03-28 17:29:56 UTC
Ubuntu mentions lightdm-1.22.0 and lightdm-1.19.5 while we have 1.26.0 stable. So I'd say this bug is obsolete.