[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 05 Jan 2015 11:08:45 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com, dev@...ts.migard-project.org,
user@...ts.migard-project.org
Subject: Re: CVE-2014-8148: midgard-core configures D-Bus system
bus to be insecure
Just a note, this was assigned CVE-2014-8148 midgard-core dbus policy
local priv escalation on vendor sec previously.
On 05/01/15 08:03 AM, Simon McVittie wrote:
> Type of vulnerability: CWE-284 Improper Access Control
> Exploitable by: local users
> Impact: could allow arbitrary code execution as root (dependent on
> installed D-Bus system services)
> Reporter: Simon McVittie, Collabora Ltd.
> Upstream notified: 2014-12-19
>
> Midgard2 is an open source content repository for data-intensive web and
> desktop applications.
>
> While checking Debian for incorrect/dangerous D-Bus security policy
> files (found in /etc/dbus-1/system.d/*.conf) I found this access control
> rule in midgard2-common/10.05.7.1-2, part of the upstream project
> midgard-core:
>
> <policy context="default"> <==== "applies to everyone"
> <allow own="org.midgardproject" /> <==== probably undesired
> <allow send_type="method_call"/> <==== definitely bad
> <allow send_type="signal" /> <==== not good either
> </policy>
>
> This is analogous to an overly permissive "chmod": it allows any process
> on the system bus to send any method call or signal to any other process
> on the system bus, including those that are normally forbidden either
> explicitly or via the system bus' documented default-deny policy. Some
> D-Bus system services perform additional authorization checks, either
> via Polkit/PolicyKit or internally, but many services rely on the system
> bus to apply their intended security model.
>
> For instance, depending on installed software, this vulnerability could
> allow unprivileged local users to:
>
> * invoke Avahi's SetHostName() method
> * communicate with bluetooth devices using BlueZ
> * install printer drivers using system-config-printer
> * run NetworkManager "dispatcher" scripts
> * ...
>
> It seems likely that at least one of these services can be used for
> arbitrary code execution as root, making this a severe vulnerability.
>
> Regards,
> S
>
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
