Date: Mon, 05 Jan 2015 15:07:41 +0000 From: Simon McVittie <simon.mcvittie@...labora.co.uk> To: oss-security@...ts.openwall.com, dev@...ts.midgard-project.org, user@...ts.midgard-project.org Subject: CVE-2014-8148: midgard-core configures D-Bus system bus to be insecure [Re-posting with upstream list addresses spelled correctly. People on oss-security: sorry for the noise, and please send any replies to this one, not to the previous attempt.] Type of vulnerability: CWE-284 Improper Access Control Exploitable by: local users Impact: could allow arbitrary code execution as root (dependent on installed D-Bus system services) Reporter: Simon McVittie, Collabora Ltd. Upstream notified: 2014-12-19 Midgard2 is an open source content repository for data-intensive web and desktop applications. While checking Debian for incorrect/dangerous D-Bus security policy files (found in /etc/dbus-1/system.d/*.conf) I found this access control rule in midgard2-common/10.05.7.1-2, part of the upstream project midgard-core: <policy context="default"> <==== "applies to everyone" <allow own="org.midgardproject" /> <==== probably undesired <allow send_type="method_call"/> <==== definitely bad <allow send_type="signal" /> <==== not good either </policy> This is analogous to an overly permissive "chmod": it allows any process on the system bus to send any method call or signal to any other process on the system bus, including those that are normally forbidden either explicitly or via the system bus' documented default-deny policy. Some D-Bus system services perform additional authorization checks, either via Polkit/PolicyKit or internally, but many services rely on the system bus to apply their intended security model. For instance, depending on installed software, this vulnerability could allow unprivileged local users to: * invoke Avahi's SetHostName() method * communicate with bluetooth devices using BlueZ * install printer drivers using system-config-printer * run NetworkManager "dispatcher" scripts * ... It seems likely that at least one of these services can be used for arbitrary code execution as root, making this a severe vulnerability. Regards, S
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ