CVE-2019-12795 Missing authorization in n/a
A local attacker can connect to an unsecured D-Bus socket in gvfsd to issue method calls, potentially leading to privilege escalation or data access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-12795?
CVE-2019-12795 is a high-severity missing authorization vulnerability in n/a, published on 11 Jun 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.)
Weakness: CWE-276
Which versions are affected by CVE-2019-12795?
It affects 1 product.
Linux distribution packages (3)
gvfs SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.28.3-18.6.1 |
gvfs SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.28.3-18.6.1 |
gvfs SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 1.28.3-18.6.1 |
Products include Gnome Gvfs.
How do I fix CVE-2019-12795?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-12795 being exploited?
There is no known exploitation of CVE-2019-12795 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as ALPINE-CVE-2019-12795, DEBIAN-CVE-2019-12795, DLA-1827-1, GHSA-whx7-c8j2-42vv, SUSE-SU-2024:2681-1, UBUNTU-CVE-2019-12795.