Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 611392

Summary: <sys-apps/dbus-1.10.18: two symlink attacks
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: normal CC: freedesktop-bugs
Priority: Normal Flags: stable-bot: sanity-check+
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: A3 [glsa]
Package list:
Runtime testing required: ---

Description Agostino Sarubbo gentoo-dev 2017-03-02 09:19:36 UTC
From ${URL} :

D-Bus <> is an
asynchronous inter-process communication system, commonly used
for system services or within a desktop session on Linux and other
operating systems.

The latest dbus release 1.10.16 fixes two symlink attacks in
non-production-suitable configurations. I am treating these as bugs
rather than practical vulnerabilities, and very much hope neither of
these is going to affect any real users, but I'm reporting them to
oss-security in case there's an attack vector that I've missed.

Please reference fd.o #99828 or
<> in any notices
that refer to these.

I have already released 1.10.16 for the stable branch. For the
development branch, 1.11.10 will have the same fixes. For the old
stable branch 1.8.x, I'm going to apply the same fixes, but I am
not planning to do a release just for this unless a vendor asks me
to - they will be released next time there is a 1.8.x release for some
other reason.

Symlink attack in nonce-tcp transport

Bug tracked as:
Versions affected: dbus >= 1.4.10
Fixed in: dbus >= 1.11.10, 1.10.x >= 1.10.16
Exploitable by: local users on inadvisably configured Unix systems
Impact: overwrite a file named "nonce" in an attacker-chosen directory
  with random contents known only to the victim
Reporter: Simon McVittie, Collabora Ltd.

The nonce-tcp transport writes a file to a randomly-named subdirectory
of a system-wide temporary directory. It does not check whether the
directory already exists (EEXIST from mkdir is ignored); so if the
chosen directory is a symlink to an attacker-chosen directory, it
would proceed to write a file named "nonce" to that directory.
The file is created safely (O_EXCL, 0600 permissions, atomic-overwrite)
and has random contents not chosen by the attacker.

The reimplementation of this transport in GDBus does not have this bug.

Mitigations include:

* The nonce-tcp transport is only enabled if you ask for it when
  configuring dbus-daemon or a DBusServer. It was added as a workaround
  for Windows' lack of AF_UNIX sockets, and the only reason it is
  available on Unix is to be able to test it. Even on Windows, it should
  never be used on connections other than loopback (there is no
  confidentiality or integrity protection).

* The directory has a random name with approximately 35 bits of entropy,
  so an attacker would have to either create a massive number of symlinks
  or be very lucky.

* The attacker cannot choose the file contents.

* The attacker cannot read the file contents.

* Versions before 1.4.10 were unaffected by this bug because nonce-tcp
  didn't work on Unix at all.

Workaround: do not use nonce-tcp. If you must use it, set the environment
variable TMPDIR to a directory you control.

Symlink attack in unit tests

Bug tracked as:
Versions affected: >= 1.1.3
Fixed in: dbus >= 1.11.10, 1.10.x >= 1.10.16
Exploitable by: local users sharing a system with a dbus developer
Impact: unlikely file overwrite
Reporter: Simon McVittie, Collabora Ltd.

One of the "embedded tests" accessed a system-wide temporary directory
in an inadvisable manner. It is probably vulnerable to a symlink
attack due to a time-of-check/time-of-use error.

Mitigations: the "embedded tests" are not compiled in by default, are
only intended to be used by dbus developers on trusted systems, and if they
are enabled, ./configure specifically warns that they are insecure. The
directory used is random with approximately 35 bits of entropy, so an
attacker would have to either create a massive number of symlinks or
be very lucky.

Workaround: if you are testing older dbus versions, use a trusted
machine, VM or container or set the environment variable TMPDIR to a
directory you control.

@maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.
Comment 1 Yury German Gentoo Infrastructure gentoo-dev 2017-04-30 16:46:21 UTC
Maintainer(s), please advise if you are ready for stabilization or call for stabilization yourself.
Comment 2 Michael Palimaka (kensington) gentoo-dev 2017-05-01 12:30:09 UTC
Arch teams, please test and stabilise sys-apps/dbus-1.10.18.
Comment 3 Agostino Sarubbo gentoo-dev 2017-05-03 08:19:33 UTC
amd64 stable
Comment 4 Jeroen Roovers (RETIRED) gentoo-dev 2017-05-04 15:08:00 UTC
Stable for HPPA.
Comment 5 Agostino Sarubbo gentoo-dev 2017-05-04 15:55:54 UTC
x86 stable
Comment 6 Markus Meier gentoo-dev 2017-05-04 20:02:57 UTC
arm stable
Comment 7 Agostino Sarubbo gentoo-dev 2017-05-12 14:55:40 UTC
sparc stable
Comment 8 Tobias Klausmann (RETIRED) gentoo-dev 2017-05-12 17:59:22 UTC
Stable on alpha.
Comment 9 Michael Weber (RETIRED) gentoo-dev 2017-05-13 20:48:17 UTC
ppc ppc64 stable.
Comment 10 Agostino Sarubbo gentoo-dev 2017-05-16 13:06:00 UTC
ppc64 stable
Comment 11 Michael Weber (RETIRED) gentoo-dev 2017-05-18 19:17:00 UTC
arm64 stable.
Comment 12 Yury German Gentoo Infrastructure gentoo-dev 2017-05-21 07:08:30 UTC
All security supported arches completed stabilization.
New GLSA Request filed.

Please complete stabilization on non supported arches.
Comment 13 GLSAMaker/CVETool Bot gentoo-dev 2017-06-06 08:53:08 UTC
This issue was resolved and addressed in
 GLSA 201706-05 at
by GLSA coordinator Thomas Deutschmann (whissi).
Comment 14 Thomas Deutschmann (RETIRED) gentoo-dev 2017-06-06 08:54:02 UTC
Re-opening to proceed with stabilization of remaining arches.
Comment 15 Agostino Sarubbo gentoo-dev 2017-06-10 15:11:49 UTC
ia64 stable.

Maintainer(s), please cleanup.
Comment 16 Michael Palimaka (kensington) gentoo-dev 2017-06-11 03:55:33 UTC
Cleanup done.
Comment 17 Thomas Deutschmann (RETIRED) gentoo-dev 2017-06-11 10:20:55 UTC
All done.
Comment 18 Sergei Trofimovich (RETIRED) gentoo-dev 2018-07-27 22:12:13 UTC
commit 3f9a90b8bb1f0b3d22e90cb187c8610dce7f487c
Author: Mikle Kolyada <>
Date:   Thu Jun 14 21:56:08 2018 +0300

    sys-apps/dbus: mark s390 stable