[Pkg-utopia-maintainers] Bug#689070: Please take upstream D-Bus patches for CVE-2012-3524

Simon McVittie smcv at debian.org
Sat Sep 29 15:03:34 UTC 2012


On 29/09/12 15:44, Simon McVittie wrote:
> I believe the libdbus part of this CVE affects wheezy and certain unusual
> squeeze configurations. The known vectors for privilege escalation are:
> 
> * tell libdbus (explicitly or via it being the session-bus default) to
>   connect to autolaunch: which results in it exec'ing dbus-launch;
>   have it not find dbus-launch in its configured ${bindir};
>   have it find a malicious dbus-launch substitute in its $PATH
> 
> * tell libdbus to connect to unixexec:something-malicious
> 
> The former is only exploitable if [... dbus-x11 is absent ...]

... and the latter is only exploitable in D-Bus 1.5.something or later,
because unixexec is a relatively new feature; so it affects wheezy but
not squeeze.

    S



More information about the Pkg-utopia-maintainers mailing list