[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120912140433.GA4786@suse.de>
Date: Wed, 12 Sep 2012 16:04:33 +0200
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Subject: libdbus CVE-2012-3524 fix
Hi,
As the CRD is today, and list policy requires "opening" the
distros-list posting, here is the forward.
As a quick fix, the exploit can also be mitigated by properly
placing the dbus-launch binary into the expected path, usually
"/bin/dbus-launch", e.g.
# ln -s /usr/bin/dbus-launch /bin/dbus-launch
since for some reason, on most dists the binary is mis-placed
into /usr/bin. This makes an execv() fail in libdbus itself,
triggering an execvp().
Sebastian
----- Forwarded message from Sebastian Krahmer <krahmer@...e.de> -----
Hi,
The recently discussed libdbus getenv() issue [1] turned out
to be easily exploitable on various UNIX systems, including
some Linux distributions. Common attack vectors are Xorg and
spice-gtk via auto-launching [2].
Properly patching requires fixes for libdbus and libgio,
depending on which you link your suid binaries.
Would be nice if someone from RH could forward their patch,
as they have some developers upstream and possibly access to
the private git commit (they also already assigned this CVE).
My CRD proposal is Sept. 12th. As can be seen in [1], this issue
is indeed public since 1+ year.
Sebastian
[1] https://bugzilla.novell.com/show_bug.cgi?id=697105
[2] http://stealth.openwall.net/null/dzug.c
PS: This is a re-send, the first mail to distros list was probably
catched by spam filter.
--
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
---
SUSE LINUX Products GmbH,
GF: Jeff Hawn, Jennifer Guild, Felix Imend?rffer, HRB 16746 (AG N?rnberg)
Maxfeldstra?e 5
90409 N?rnberg
Germany
----- End forwarded message -----
--
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
