Msatdt

PackageKit is a D-Bus abstraction layer used to manage packages across different distributions and architectures. A time-of-check time-of-use (TOCTOU) race condition exists in the handling of transaction flags, which allows a local unprivileged user to install arbitrary RPM packages as root without authentication, leading to local privilege escalation. This issue, dubbed Pack2TheRoot, can be triggered via the `pkcon install` command. The flaw involves three bugs in `src/pk-transaction.c`: 1. The `InstallFiles()` function unconditionally overwrites `transaction->cached transaction flags` with caller-supplied flags, even if the transaction is already running. 2. The `pk transaction set state()` function silently rejects backward state transitions (such as `RUNNING` to `WAITING FOR AUTH`), allowing the transaction to proceed with corrupted flags. 3. The scheduler's idle callback reads `transaction->cached transaction flags` at dispatch time rather than authorization time, causing the backend to execute the attacker's flags. Exploitation may cause an assertion failure in the PackageKit daemon, resulting in a crash that is visible in system logs.

Kanboard is project management software that focuses on the Kanban methodology. In affected versions, sessions are still usable even though their lifetime has exceeded. Kanboard implements a custom session handler (`app/Core/Session/SessionHandler.php`), to store the session data in a database. When a `session id` is given, Kanboard queries the data from the `sessions` SQL table. However, it does not correctly verify if a given `session id` has already exceeded its lifetime (`expires at`). Thus, a session whose lifetime is already `> time()`, is still queried from the database and hence a valid login. The implemented `SessionHandlerInterface::gc` function, which removes invalid sessions, is called only with a certain probability, based on `session.gc divisor`, `session.gc probability`, and `session.gc maxlifetime` settings. In the official Kanboard Docker image, these values default to: `session.gc probability=1`, `session.gc divisor=1000`. Thus, an expired session is only terminated with a probability of 1/1000.

Name of the Vulnerable Software and Affected Versions: Kanboard versions prior to 1.2.42 Description: The issue is related to incorrect restriction of a directory path with limited access in Kanboard project management software. This can allow a remote attacker to read and delete arbitrary files from the server. An authenticated Kanboard admin can exploit this by uploading a modified SQLite database through a dedicated feature, setting arbitrary file links by abusing path traversals, and triggering a file download. This allows the attacker to download all files readable in the context of the Kanboard application permissions. Recommendations: For versions prior to 1.2.42, update to version 1.2.42 to fix the issue. As a temporary workaround, consider restricting access to the `project has files` SQLite database and the file upload feature to minimize the risk of exploitation. Avoid using the `path` entry in the `project has files` SQLite database until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Kanboard versions prior to 1.2.42 Description: The issue concerns the Kanboard project management software, which focuses on the Kanban methodology. An authenticated Kanboard admin can execute arbitrary PHP code on the server due to a path traversal vulnerability. This can be achieved by uploading a modified sqlite.db file, which allows an attacker to control the filepath loaded by the application. The attacker must be able to place a file called `translations.php` on the system, potentially through an anonymous FTP server or another application that allows file uploads. Once the file is in place, the attacker can craft a sqlite db settings file that uses path traversal to point to the directory where the `translations.php` file is stored, ultimately gaining code execution after importing the crafted sqlite.db. Recommendations: For versions prior to 1.2.42, upgrade to version 1.2.42 to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the `translations.php` file and disabling any features that allow uploading files to the system until the upgrade is applied. Avoid using the `application language` setting in the `settings` table to load user interface languages from untrusted sources.