Improper D-Bus Security Configuration in Tizen Affects Package Management

CVE-2018-16262

Summary

The pkgmgr system service in Tizen is vulnerable due to incorrect configurations in its D-Bus security policy, permitting an unprivileged process to execute critical package management operations. These include the ability to install, decrypt, and terminate other software packages. This flaw specifically impacts Tizen versions prior to 5.0 M1 and several Tizen-based firmware versions on devices like the Samsung Galaxy Gear series, allowing unauthorized actions that compromise the integrity and safety of the device's operating environment.

References