CVE-2019-15718: Medium severity systemd vulnerability
An improper authorization flaw was discovered in systemd-resolved in the way it configures the exposed DBus interface org.freedesktop.resolve1. An unprivileged local attacker could call all DBus methods, even when marked as privileged operations. An attacker could abuse this flaw by changing the DNS, Search Domain, LLMNR, DNSSEC and other network link settings without any authorization, allowing control of the network names resolution process and cause the system to communicate with wrong or malicious servers.
Other sources
In systemd 240, busopensystemwatchbindwithdescription in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sdbussettrusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.
systemd-resolved does not properly enforce any access control to its dbus methods, allowing any unprivileged user to access its API. An attacker may use this flaw to configure the DNS, the Default Route or other properties of a network link. Those operations should be performed only by an high-privileged user.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-15718.
What is the severity of CVE-2019-15718?
The severity of CVE-2019-15718 is medium with a CVSS score of 5.3.
What is the affected software of CVE-2019-15718?
The affected software includes systemd versions 240, 243, and earlier, as well as Red Hat Enterprise Linux 8.0, 8.1, 8.2, 8.4, and other related distributions.
How can an attacker exploit CVE-2019-15718?
An attacker can exploit CVE-2019-15718 by calling all DBus methods, even privileged operations, through the exposed DBus interface org.freedesktop.resolve1.
Where can I find more information about CVE-2019-15718?
More information about CVE-2019-15718 can be found at the following references: [GitHub Pull Request](https://github.com/systemd/systemd/pull/13457), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1748767).