Ubuntu 20.04 LTS: USN-4507-1 High: systemd Security Vulnerability

ubuntu

October 4, 2012

DBus could be made to run programs as an administrator.

Summary

DBus could be made to run programs as an administrator.

Software Description:

- dbus: simple interprocess messaging system

Details:

USN-1576-1 fixed vulnerabilities in DBus. The update caused a regression

for certain services launched from the activation helper, and caused an

unclean shutdown on upgrade. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Sebastian Krahmer discovered that DBus incorrectly handled environment

variables when running with elevated privileges. A local attacker could

possibly exploit this flaw with a setuid binary and gain root privileges.

Topics Covered

security advisory moderate privilege escalation Ubuntu local attack regression DBus

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  dbus                            1.4.18-1ubuntu1.3
  libdbus-1-3                     1.4.18-1ubuntu1.3

Ubuntu 11.10:
  dbus                            1.4.14-1ubuntu1.3
  libdbus-1-3                     1.4.14-1ubuntu1.3

Ubuntu 11.04:
  dbus                            1.4.6-1ubuntu6.4
  libdbus-1-3                     1.4.6-1ubuntu6.4

Ubuntu 10.04 LTS:
  dbus                            1.2.16-2ubuntu4.7
  libdbus-1-3                     1.2.16-2ubuntu4.7

Ubuntu 8.04 LTS:
  dbus                            1.1.20-1ubuntu3.9
  libdbus-1-3                     1.1.20-1ubuntu3.9

In general, a standard system update will make all the necessary changes.