Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Gentoo: GLSA 201701-20 Moderate: D-Bus Format String DoS Issue

gentoo
Calendar Grey January 11, 2017
Dist Gentoo Esm H88
D-Bus contains a significant format string vulnerability which may result in a local denial of service condition. Prompt updates are advised.
A vulnerability has been found in D-Bus possibly resulting in a local Denial of Service.

Summary

It was discovered that D-Bus incorrectly handles certain format strings. The impact of this new vulnerability is believed to not be exploitable if D-Bus is patched against CVE-2015-0245. The previous vulnerability (CVE-2015-0245) was addressed in GLSA-201503-02 referenced below.

Topics%20covered

Topics Covered

security advisory denial of service gentoo format string d-bus

Resolution

All D-Bus users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.10.12"

References

[ 1 ] GLSA-201503-02 https://security.gentoo.org/glsa/201503-02

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201701-20
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: D-Bus: Format string vulnerability
Date: January 11, 2017
Bugs: #596772
ID: 201701-20

Topics%20covered

Topics Covered

security advisory denial of service gentoo format string d-bus

Synopsis

A vulnerability has been found in D-Bus possibly resulting in a local Denial of Service.

Background

D-Bus is a message bus system, a simple way for applications to talk to one another.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-apps/dbus < 1.10.12 >= 1.10.12

Impact

===== A local attacker could cause a Denial of Service condition or possibly execute arbitrary code.

Workaround

The vulnerable D-Bus interface is intended only for use by systemd running as root. The administrator can install a policy which denies sending from org.freedesktop.systemd1.Activator" to D-Bus. This will prevent non-root attackers from reaching the interface in order to exercise this flaw.

Your message here