[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130223073447.GA23632@suse.de>
Date: Sat, 23 Feb 2013 08:34:47 +0100
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: CVE Request: PackageKit"update" allows downgrade of packages when
using the "zypp" backend
Hi,
On openSUSE we have started to allow local logged in users to install
online updates (but not install new packages or remove ones), as this
seems a common and secure operation to us.
(Also done in light of the Linus Torvalds flame posting.)
PolicyKit rules in PackageKit also allow this in the vanilla version:
org.freedesktop.packagekit.system-update
shipping default is "yes" for local logged-in active users.
So far we assumed that the update operation only allows upgrading versions.
The enforcement of this rule did not fully work, so at least the "zypp"
backend of PackageKit allowed downgrade of packages using this call.
The "update" method also allowed installing non-update resolvables like
patterns or even new packages.
We have not checked the other backends, they might also be affected.
https://bugzilla.novell.com/show_bug.cgi?id=804983
https://bugs.freedesktop.org/show_bug.cgi?id=61231
https://gitorious.org/packagekit/packagekit/commit/d3d14631042237bcfe6fb30a60e59bb6d94af425
As the default assumed secure behaviour is violated, this requires a CVE.
Ciao, Marcus
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
