Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 569
Alerts This Week
Warning Icon 1 569

Gentoo: GLSA-201706-05 Normal: D-Bus File Overwrite and Symlink Threat

gentoo
Calendar Grey June 6, 2017
Scroller Gentoo
D-Bus contains various security flaws that enable file replacement and symlink attacks. It is advisable for users to update their systems.
Multiple vulnerabilities in D-Bus might allow an attacker to overwrite files with a fixed filename in arbitrary directories or conduct a symlink attack

Summary

Multiple vulnerabilities have been discovered in D-Bus. Please review the original report referenced below for details.

Topics%20covered

Topics Covered

security advisory Gentoo file overwrite symlink attack upgrade recommendation normal D-Bus

Resolution

All D-Bus users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.10.18"

References

[ 1 ] Original report http://www.openwall.com/lists/oss-security/2017/02/16/4

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201706-05
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: D-Bus: Multiple vulnerabilities
Date: June 06, 2017
Bugs: #611392
ID: 201706-05

Topics%20covered

Topics Covered

security advisory Gentoo file overwrite symlink attack upgrade recommendation normal D-Bus

Synopsis

Multiple vulnerabilities in D-Bus might allow an attacker to overwrite files with a fixed filename in arbitrary directories or conduct a symlink attack.

Background

D-Bus is a message bus system which processes can use to talk to each other.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-apps/dbus < 1.10.18 >= 1.10.18

Impact

===== An attacker could possibly overwrite arbitrary files named "once" with content not controlled by the attacker. A local attacker could perform a symlink attack against D-Bus' test suite.

Workaround

There is no known workaround at this time.