From ${URL} : Bug tracked as: CVE-2015-0245 Bug tracked as: https://bugs.freedesktop.org/show_bug.cgi?id=88811 Versions affected: dbus >= 1.4.0 Versions fixed: >= 1.9.10, 1.8.x >= 1.8.16, 1.6.x >= 1.6.30 Type of vulnerability: CWE-285 Improper Authorization Exploitable by: local users Impact: denial of service Reporter: Simon McVittie, Collabora Ltd. D-Bus <http://www.freedesktop.org/wiki/Software/dbus/> is an asynchronous inter-process communication system, commonly used for system services or within a desktop session on Linux and other operating systems. dbus-daemon can "activate" (auto-start) D-Bus services on-demand when it receives a message addressed to them. In versions >= 1.4.0 of dbus, it can do this by using a D-Bus signal to ask systemd to carry out the actual service start. systemd sends back an ActivationFailure D-Bus signal if the activation fails. However, when it receives these signals, dbus-daemon does not verify that the signal actually came from systemd. A malicious local user could send repeated ActivationFailure signals in the hope that it would "win the race" with the genuine signal, causing D-Bus to send back an error to the client that requested activation. Mitigation: the system service is not actually prevented from starting or claiming its well-known bus name, and after it has done so, subsequent clients can communicate with it as usual. The recommended fix for stable distributions is to alter system.conf similar to the attached patch (commit link below), or upgrade to version 1.8.16 or 1.6.30. This restricts the attack to uid 0, making it a non-issue in practice. http://cgit.freedesktop.org/dbus/dbus/commit/?id=6dbd09fedc396c53b25ea73c6c8a278beca349c7 The full solution involves additional code changes and has only been made in the 1.9 development branch so far, but is easy to backport to 1.8 if required (e.g. for environments where uid 0 is not all-powerful due to use of LSMs). It requires two additional commits: http://cgit.freedesktop.org/dbus/dbus/commit/?id=aaea59916398d1c590490edb0471a01bcf20e6d7 http://cgit.freedesktop.org/dbus/dbus/commit/?id=03c5e161752fe1ff4925955800ca9c78d09a6e0c @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
10 Feb 2015; Kristian Fiskerstrand <k_f@gentoo.org> +dbus-1.8.16.ebuild: Security bump for #539482. Proxy commit for ssuominen. Arches, please stabilize: =sys-apps/dbus-1.8.16 Stable targets: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
Stable for HPPA.
amd64 stable
x86 stable
CVE-2015-0245 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0245): D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
sparc stable
arm stable
ppc64 stable
ppc stable
ia64 stable
alpha stable. Maintainer(s), please cleanup. Security, please add it to the existing request, or file a new one.
Arches, Thank you for your work. New GLSA Request filed. Maintainer(s), please drop the vulnerable version(s).
+ 28 Feb 2015; Kristian Fiskerstrand <k_f@gentoo.org> -dbus-1.8.10.ebuild, + -dbus-1.8.12.ebuild: + Security cleanup for bug #539482
This issue was resolved and addressed in GLSA 201503-02 at http://security.gentoo.org/glsa/glsa-201503-02.xml by GLSA coordinator Sergey Popov (pinkbyte).
