Severe Security Vulnerability in D-Bus for Ubuntu 12.04 LTS Users

ubuntu

September 20, 2012

DBus could be made to run programs as an administrator.

Summary

DBus could be made to run programs as an administrator.

Software Description:

- dbus: simple interprocess messaging system

Details:

Sebastian Krahmer discovered that DBus incorrectly handled environment

variables when running with elevated privileges. A local attacker could

possibly exploit this flaw with a setuid binary and gain root privileges.

Topics Covered

security advisory critical privilege escalation ubuntu dbus

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  dbus                            1.4.18-1ubuntu1.1
  libdbus-1-3                     1.4.18-1ubuntu1.1

Ubuntu 11.10:
  dbus                            1.4.14-1ubuntu1.1
  libdbus-1-3                     1.4.14-1ubuntu1.1

Ubuntu 11.04:
  dbus                            1.4.6-1ubuntu6.2
  libdbus-1-3                     1.4.6-1ubuntu6.2

Ubuntu 10.04 LTS:
  dbus                            1.2.16-2ubuntu4.5
  libdbus-1-3                     1.2.16-2ubuntu4.5

Ubuntu 8.04 LTS:
  dbus                            1.1.20-1ubuntu3.7
  libdbus-1-3                     1.1.20-1ubuntu3.7

In general, a standard system update will make all the necessary changes.