Bug 435694 (CVE-2012-4425)

Summary:	<net-misc/spice-gtk-0.14: privilege escalation and code exec vulnerability (CVE-2012-4425)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	dev-zero, nirbheek, virtualization
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B4 [glsa]
Package list:		Runtime testing required:	---
Bug Depends on:	444224
Bug Blocks:

Description GLSAMaker/CVETool Bot gentoo-dev

2012-09-20 23:05:23 UTC

CVE-2012-4425 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4425):
  libgio, when used in setuid or other privileged programs in spice-gtk and
  possibly other products, allows local users to gain privileges and execute
  arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable.  NOTE:
  it could be argued that this is a vulnerability in the applications that do
  not cleanse environment variables, not in libgio itself.


Looks like a patch may be available at:

http://permalink.gmane.org/gmane.linux.redhat.fedora.extras.cvs/853051

Comment 1 Doug Goldstein (RETIRED) gentoo-dev

2012-10-04 18:08:28 UTC

Rough look at the issue appears that it exists before the 0.14 release. Not sure how long it exists before that.

Comment 2 Sean Amoss (RETIRED) gentoo-dev

2012-11-26 12:30:56 UTC

GLSA vote: yes.

Comment 3 Stefan Behte (RETIRED) gentoo-dev

2012-12-16 21:53:49 UTC

Vote: yes. GLSA request filed.

Comment 4 GLSAMaker/CVETool Bot gentoo-dev

2014-06-26 23:37:32 UTC

This issue was resolved and addressed in
 GLSA 201406-29 at http://security.gentoo.org/glsa/glsa-201406-29.xml
by GLSA coordinator Chris Reffett (creffett).