CVE-2012-5560: Low severity Mate-desktop Mate-settings-daemon vulnerability
The default configuration in mate-settings-daemon 1.5.3 allows local users to change the timezone for the system via a crafted D-Bus call.
Other sources
Version-Release number of selected component (if applicable): e.g. mate-settings-daemon-1.5.3-1.fc8
mate-settings-daemon's datetime mechanism provides a D-Bus method to set the timezone, which is guarded by polkit's action org.mate.settingsdaemon.datetimemechanism.settimezone; this has the default policy "authselfkeep", which allows any local user to perform the operation with only knowing their own password.
This seems not to be currently exposed in the mate UI, but it is available through manual D-Bus calls, e.g. dbus-send --system --print-reply --type=methodcall --dest=org.mate.SettingsDaemon.DateTimeMechanism / org.mate.SettingsDaemon.DateTimeMechanism.SetTimezone string:/usr/share/zoneinfo/Cuba
Because the time zone setting is a global resource, it should be restricted to system administrators (== root or users in the "wheel" group), by having a policy authadmin. That's also what the other timezone setting mechanisms (in systemd and control-center) do.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5560?
CVE-2012-5560 is classified as a low-severity vulnerability since it allows local users to change the system's timezone, which does not have a significant impact on confidentiality or integrity.
How do I fix CVE-2012-5560?
To fix CVE-2012-5560, you should upgrade mate-settings-daemon to version 1.5.4 or later, where the vulnerability has been addressed.
Who is affected by CVE-2012-5560?
Users of mate-settings-daemon version 1.5.3 are affected by CVE-2012-5560 if they have default configurations that allow D-Bus calls.
What is the impact of exploiting CVE-2012-5560?
Exploiting CVE-2012-5560 allows local users to change the system's timezone, which may lead to potential confusion in system logs and scheduled tasks.
Is there a way to mitigate CVE-2012-5560 without upgrading?
As a temporary mitigation for CVE-2012-5560, you can restrict D-Bus access and configuration to prevent unauthorized local users from changing the timezone.