Date: Wed, 12 Sep 2012 16:04:33 +0200 From: Sebastian Krahmer <krahmer@...e.de> To: oss-security@...ts.openwall.com Subject: libdbus CVE-2012-3524 fix Hi, As the CRD is today, and list policy requires "opening" the distros-list posting, here is the forward. As a quick fix, the exploit can also be mitigated by properly placing the dbus-launch binary into the expected path, usually "/bin/dbus-launch", e.g. # ln -s /usr/bin/dbus-launch /bin/dbus-launch since for some reason, on most dists the binary is mis-placed into /usr/bin. This makes an execv() fail in libdbus itself, triggering an execvp(). Sebastian ----- Forwarded message from Sebastian Krahmer <krahmer@...e.de> ----- Hi, The recently discussed libdbus getenv() issue  turned out to be easily exploitable on various UNIX systems, including some Linux distributions. Common attack vectors are Xorg and spice-gtk via auto-launching . Properly patching requires fixes for libdbus and libgio, depending on which you link your suid binaries. Would be nice if someone from RH could forward their patch, as they have some developers upstream and possibly access to the private git commit (they also already assigned this CVE). My CRD proposal is Sept. 12th. As can be seen in , this issue is indeed public since 1+ year. Sebastian  https://bugzilla.novell.com/show_bug.cgi?id=697105  http://stealth.openwall.net/null/dzug.c PS: This is a re-send, the first mail to distros list was probably catched by spam filter. -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer@...e.de - SuSE Security Team --- SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imend?rffer, HRB 16746 (AG N?rnberg) Maxfeldstra?e 5 90409 N?rnberg Germany ----- End forwarded message ----- -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer@...e.de - SuSE Security Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ