Date: Mon, 4 May 2015 01:43:48 -0400 (EDT) From: cve-assign@...re.org To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: Re: USBCreator D-Bus service -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > http://openwall.com/lists/oss-security/2015/04/22/12 > On my Ubuntu VM, I have a D-Bus service listening on > com.ubuntu.USBCreator. As far as I can tell, this is installed by > default. > It looks like the author intended for all the methods to call > check_polkit, but KVMTest doesn't. > the following appears to work > on my machine: > dbus-send --print-reply --system --dest=com.ubuntu.USBCreator > /com/ubuntu/USBCreator com.ubuntu.USBCreator.KVMTest ... > dict:string:string:DISPLAY,"foo",XAUTHORITY,"foo",LD_PRELOAD,"/tmp/test.so" As far as we know, this affects only Ubuntu, and although people from Ubuntu discussed the announcement here, apparently nobody from Ubuntu sent a message here stating that they concluded it was a single vulnerability that didn't yet have a CVE ID. We found that that's the state by reading: http://bazaar.launchpad.net/~usb-creator-hackers/usb-creator/trunk/revision/470 Use CVE-2015-3643. > http://openwall.com/lists/oss-security/2015/04/24/5 As far as we can tell, this followup post doesn't announce an additional vulnerability. Apparently, the goal of that post was to describe how to check for some of the exploitation preconditions, and suggest the possibility of bypassing a precondition. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVRwacAAoJEKllVAevmvms1VoIAJnDJUPom/68ET3hv2D0+qfs BUFj/DXxIXDM19x4ayME7eCh9kauLK79qxFwV2bfsvE/qKEd+2YKmFp3BkveJdE/ gpNIaxOpLL6/D+LkjMAeEgekVA2ScEhU3TZYsHAiYUQvivfDKbYbwfSQsYc6qKit F6fG0Hyg7ic5Au9pH6faIHmQbBKWCFQQ2QfaiKNOOXBObCq9aCwo5YfWjoGdeH10 H0CJ8ePZ49oIBrYymQRnQ4aEaH974g/N3rii/R9kVhTTrFmHoFs8mgnGlwleB9my 6bysckwfVPXUlNw44ugnz6fu+AxuoKdAnOCtXAIf9oIy8GOhc9sVqdXU5blx2og= =gCRz -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ