oss-security - CVE-2013-0292: authentication bypass due to insufficient checks in dbus-glib

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <511E715F.1040105@collabora.co.uk>
Date: Fri, 15 Feb 2013 17:33:19 +0000
From: Simon McVittie <simon.mcvittie@...labora.co.uk>
To: oss-security@...ts.openwall.com
CC: "dbus@...ts.freedesktop.org" <dbus@...ts.freedesktop.org>, 
 ftp-release@...ts.freedesktop.org
Subject: CVE-2013-0292: authentication bypass due to insufficient checks in
 dbus-glib < 0.100.1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Sebastian Krahmer discovered and published an authentication bypass
vulnerability in pam_fprintd, caused by a bug in dbus-glib. It is
possible that other users of dbus-glib can be exploited in the same
way. CVE-2013-0292 has been allocated for this vulnerability.

This vulnerability is fixed in dbus-glib version 0.100.1 by git commit
166978a. All users of dbus-glib should upgrade.

<http://dbus.freedesktop.org/releases/dbus-glib/dbus-glib-0.100.1.tar.gz>
<http://dbus.freedesktop.org/releases/dbus-glib/dbus-glib-0.100.1.tar.gz.asc>
<http://cgit.freedesktop.org/dbus/dbus-glib/commit/?id=166978a09cf5edff4028e670b6074215a4c75eca>

The D-Bus maintainers consider use of dbus-glib to be deprecated. We
encourage GLib application and library authors to switch to GDBus, which
has been part of GLib since 2.26.

Thanks to Sebastian Krahmer and Bastien Nocera for bringing this
vulnerability to our attention, and the Red Hat Security Response Team
for allocating a CVE ID.

Regards,
    S

-----BEGIN PGP SIGNATURE-----

iQIVAwUBUR5xU03o/ypjx8yQAQj5hg//aY5om9cxEgRclJ8zbcy57iQGM1vLgm4l
bBLqvj2PgS8viumcTfrOg4WRpS6/IqROW/5rY+/knJX0HxgGXueo04Vt9gI2cH8C
uPIb1OOO5+Aym8pvF4zHGk7HUu7vi76c0FeiA0ftDY8iqgJln9tKTACTgTD1DgIE
ktGwEDWbJEBQoGpheu/5my7XTx+GHt9Jc0ERA3XAFYrbvw52oV2oLHoKwuPkVjip
jMQL4+swp3uDtM3P4wSnzXQogchK5k8o2h4CmAPhsrayYXUGMB8eCZW/QdO/Z/bv
US3bRSitV1isXpAMyYMxvXPrwgliwEJYDufkOTt2KmWsVa9JdEl4FjZkugng/TJo
NCK2LM36AySOSoLd6drDLLlcqZ/639/szxm1+Q2wDq7zVD/m7MRbEzTZmiYiuJxr
+0bLl8SgZ/wJf+k08esFDNTNSvEOIUpXiIhWqlEtYW7nsgjZts/0ki2l6xnARqfO
6zc0fVpK5yWCX1x2r1IBTgMfXxzEXIG8HFHHNmUVAtYqwPVGFpYi7qibUH98qSUC
7HeJN7vffTLAj5FObyKa+YbNFjJRotX5TX805YIaZuxM6H3xChQfD/eHyuMiP/gf
ehJlsYE535gYGVVOodPCQQ6VNvTnYLSsHyXghHlaoAH/fm6vGOVtA898YpNP8ORL
uxxF6c7yPa4=
=Dr98
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.