ID CVE-2018-6560
Summary In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.
References
Vulnerable Configurations
  • cpe:2.3:a:flatpak:flatpak:0.1:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.2:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.3:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.3.5:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.3.6:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.5:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.6:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.6:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.7:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.7:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.8:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.8:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.9:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.9:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.10:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.10:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.11:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.11:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.12:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.12:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.4.13:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.4.13:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.4:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.5:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.5:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.6:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.7:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.7:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.8:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.8:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.9:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.9:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.10:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.10:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.11:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.11:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.12:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.12:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.13:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.13:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.6.14:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.6.14:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.8.2:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.8.3:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.8.3:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.8.4:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.8.5:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.8.5:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.8.6:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.8.6:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.8.7:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.8.7:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.8.8:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.8.8:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.1:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.1:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.2:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.2:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.3:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.3:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.4:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.4:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.5:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.5:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.6:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.6:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.7:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.7:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.8:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.8:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.9:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.9:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.10:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.10:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.11:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.11:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.12:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.12:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.98:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.98:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.98.1:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.98.1:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.98.2:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.98.2:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.9.99:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.9.99:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.10.0:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.10.0:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.10.1:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.10.1:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.10.2:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.10.2:*:*:*:*:*:*:*
  • cpe:2.3:a:flatpak:flatpak:0.10.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:flatpak:flatpak:0.10.2.1:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
CVSS
Base: 4.6 (as of 03-10-2019 - 00:03)
Impact:
Exploitability:
CWE CWE-436
CAPEC
  • HTTP Request Splitting
    HTTP Request Splitting (also known as HTTP Request Smuggling) is an attack pattern where an attacker attempts to insert additional HTTP requests in the body of the original (enveloping) HTTP request in such a way that the browser interprets it as one request but the web server interprets it as two. There are several ways to perform HTTP request splitting attacks. One way is to include double Content-Length headers in the request to exploit the fact that the devices parsing the request may each use a different header. Another way is to submit an HTTP request with a "Transfer Encoding: chunked" in the request header set with setRequestHeader to allow a payload in the HTTP Request that can be considered as another HTTP Request by a subsequent parsing entity. A third way is to use the "Double CR in an HTTP header" technique. There are also a few less general techniques targeting specific parsing vulnerabilities in certain web servers.
  • HTTP Response Smuggling
    An attacker injects content into a server response that is interpreted differently by intermediaries than it is by the target browser. To do this, it takes advantage of inconsistent or incorrect interpretations of the HTTP protocol by various applications. For example, it might use different block terminating characters (CR or LF alone), adding duplicate header fields that browsers interpret as belonging to separate responses, or other techniques. Consequences of this attack can include response-splitting, cross-site scripting, apparent defacement of targeted sites, cache poisoning, or similar actions.
  • HTTP Request Smuggling
    HTTP Request Smuggling results from the discrepancies in parsing HTTP requests between HTTP entities such as web caching proxies or application firewalls. Entities such as web servers, web caching proxies, application firewalls or simple proxies often parse HTTP requests in slightly different ways. Under specific situations where there are two or more such entities in the path of the HTTP request, a specially crafted request is seen by two attacked entities as two different sets of requests. This allows certain requests to be smuggled through to a second entity without the first one realizing it.
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:L/AC:L/Au:N/C:P/I:P/A:P
redhat via4
advisories
bugzilla
id 1542207
title CVE-2018-6560 flatpak: sandbox escape in D-Bus filtering by a crafted authentication handshake
oval
AND
  • OR
    • comment Red Hat Enterprise Linux 7 Client is installed
      oval oval:com.redhat.rhba:tst:20150364001
    • comment Red Hat Enterprise Linux 7 Server is installed
      oval oval:com.redhat.rhba:tst:20150364002
    • comment Red Hat Enterprise Linux 7 Workstation is installed
      oval oval:com.redhat.rhba:tst:20150364003
    • comment Red Hat Enterprise Linux 7 ComputeNode is installed
      oval oval:com.redhat.rhba:tst:20150364004
  • OR
    • AND
      • comment flatpak is earlier than 0:0.8.8-4.el7_5
        oval oval:com.redhat.rhsa:tst:20182766011
      • comment flatpak is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20182766012
    • AND
      • comment flatpak-builder is earlier than 0:0.8.8-4.el7_5
        oval oval:com.redhat.rhsa:tst:20182766007
      • comment flatpak-builder is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20182766008
    • AND
      • comment flatpak-devel is earlier than 0:0.8.8-4.el7_5
        oval oval:com.redhat.rhsa:tst:20182766005
      • comment flatpak-devel is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20182766006
    • AND
      • comment flatpak-libs is earlier than 0:0.8.8-4.el7_5
        oval oval:com.redhat.rhsa:tst:20182766009
      • comment flatpak-libs is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20182766010
rhsa
id RHSA-2018:2766
released 2018-09-25
severity Moderate
title RHSA-2018:2766: flatpak security update (Moderate)
rpms
  • flatpak-0:0.8.8-4.el7_5
  • flatpak-builder-0:0.8.8-4.el7_5
  • flatpak-devel-0:0.8.8-4.el7_5
  • flatpak-libs-0:0.8.8-4.el7_5
refmap via4
confirm
Last major update 03-10-2019 - 00:03
Published 02-02-2018 - 14:29
Back to Top