Msatdt

PackageKit هي طبقة تجريد D-Bus تُستخدم لإدارة الحزم في توزيعات وبنيات مختلفة. توجد حالة تضارب بين وقت التحقق ووقت الاستخدام (TOCTOU) في معالجة علامات المعاملات، مما يسمح لمستخدم محلي غير متمتع بامتيازات بتثبيت حزم RPM عشوائية بصفة root دون مصادقة، مما يؤدي إلى تصعيد الامتيازات المحلية. يمكن استغلال هذه المشكلة، التي أُطلق عليها اسم Pack2TheRoot، من خلال الأمر `pkcon install`. تتضمن هذه الثغرة ثلاثة أخطاء في `src/pk-transaction.c`: 1. تقوم الدالة `InstallFiles()` بالكتابة فوق `transaction->cached transaction flags` دون شروط باستخدام العلامات المقدمة من قبل المستدعي، حتى لو كانت المعاملة قيد التنفيذ بالفعل. 2. ترفض الدالة `pk transaction set state()` بصمت انتقالات الحالة الرجعية (مثل الانتقال من `RUNNING` إلى `WAITING FOR AUTH`)، مما يسمح للمعاملة بالاستمرار باستخدام علامات تالفة. 3. تقوم دالة الاستدعاء الخاملة للمجدول بقراءة `transaction->cached transaction flags` في وقت التوزيع، وليس في وقت التفويض، مما يؤدي إلى قيام الخلفية بتنفيذ علامات المخترق. قد يؤدي استغلال هذه الثغرة إلى حدوث خطأ في التحقق في برنامج PackageKit الخفي، مما يؤدي إلى تعطل يظهر في سجلات النظام.

Kanboard is project management software that focuses on the Kanban methodology. In affected versions, sessions are still usable even though their lifetime has exceeded. Kanboard implements a custom session handler (`app/Core/Session/SessionHandler.php`), to store the session data in a database. When a `session id` is given, Kanboard queries the data from the `sessions` SQL table. However, it does not correctly verify if a given `session id` has already exceeded its lifetime (`expires at`). Thus, a session whose lifetime is already `> time()`, is still queried from the database and hence a valid login. The implemented `SessionHandlerInterface::gc` function, which removes invalid sessions, is called only with a certain probability, based on `session.gc divisor`, `session.gc probability`, and `session.gc maxlifetime` settings. In the official Kanboard Docker image, these values default to: `session.gc probability=1`, `session.gc divisor=1000`. Thus, an expired session is only terminated with a probability of 1/1000.

Name of the Vulnerable Software and Affected Versions: Kanboard versions prior to 1.2.42 Description: The issue is related to incorrect restriction of a directory path with limited access in Kanboard project management software. This can allow a remote attacker to read and delete arbitrary files from the server. An authenticated Kanboard admin can exploit this by uploading a modified SQLite database through a dedicated feature, setting arbitrary file links by abusing path traversals, and triggering a file download. This allows the attacker to download all files readable in the context of the Kanboard application permissions. Recommendations: For versions prior to 1.2.42, update to version 1.2.42 to fix the issue. As a temporary workaround, consider restricting access to the `project has files` SQLite database and the file upload feature to minimize the risk of exploitation. Avoid using the `path` entry in the `project has files` SQLite database until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Kanboard versions prior to 1.2.42 Description: The issue concerns the Kanboard project management software, which focuses on the Kanban methodology. An authenticated Kanboard admin can execute arbitrary PHP code on the server due to a path traversal vulnerability. This can be achieved by uploading a modified sqlite.db file, which allows an attacker to control the filepath loaded by the application. The attacker must be able to place a file called `translations.php` on the system, potentially through an anonymous FTP server or another application that allows file uploads. Once the file is in place, the attacker can craft a sqlite db settings file that uses path traversal to point to the directory where the `translations.php` file is stored, ultimately gaining code execution after importing the crafted sqlite.db. Recommendations: For versions prior to 1.2.42, upgrade to version 1.2.42 to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the `translations.php` file and disabling any features that allow uploading files to the system until the upgrade is applied. Avoid using the `application language` setting in the `settings` table to load user interface languages from untrusted sources.