CVE-2019-14822: High severity IBM Security Guardium vulnerability
A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user.
Other sources
IBus could allow a local authenticated attacker to bypass security restrictions, caused by improper authorization validation. By sending a specially-crafted request, an attacker could exploit this vulnerability to monitor and send method calls to the ibus bus of another user.
— IBM
ibus uses a GDBusServer with GDBUSSERVERFLAGSAUTHENTICATIONALLOWANONYMOUS, and doesn't set a GDBusAuthObserver, which allows anyone who can connect to its AFUNIX socket to authenticate and be authorized to send method calls. It also seems to use an abstract AFUNIX socket, which does not have filesystem permissions, so the practical effect might be that a local attacker can connect to another user's ibus service and make arbitrary method calls.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-14822?
CVE-2019-14822 is a vulnerability in the ibus package that allows unprivileged users to monitor and intercept keystrokes of another user due to a misconfiguration in the DBus server setup.
How severe is CVE-2019-14822?
CVE-2019-14822 has a severity score of 7.1, which is considered high.
Which software versions are affected by CVE-2019-14822?
The affected software versions include ibus before 1.5.22, 1.5.17-3ubuntu5.3, 1.5.21-1~, 1.5.11-1ubuntu2.4, 1.5.19-4+deb10u1, 1.5.23-2, 1.5.27-5, and 1.5.29~rc1-1.
How can I fix CVE-2019-14822?
To fix CVE-2019-14822, upgrade to ibus version 1.5.22 or apply the specific remedy provided by your operating system.
Where can I find more information about CVE-2019-14822?
You can find more information about CVE-2019-14822 in the references: [1] [2].