Ubuntu 16.04 LTS USN-3116-1: DBus Denial of Service Issues

ubuntu

November 1, 2016

Several security issues were fixed in DBus.

Summary

Several security issues were fixed in DBus.

Software Description:

- dbus: simple interprocess messaging system

Details:

It was discovered that DBus incorrectly validated the source of

ActivationFailure signals. A local attacker could use this issue to cause a

denial of service. This issue only applied to Ubuntu 12.04 LTS and Ubuntu

14.04 LTS. (CVE-2015-0245)

It was discovered that DBus incorrectly handled certain format strings. A

local attacker could use this issue to cause a denial of service, or

possibly execute arbitrary code. This issue is only exposed to unprivileged

users when the fix for CVE-2015-0245 is not applied, hence this issue is

only likely to affect Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Ubuntu 16.04

LTS and Ubuntu 16.10 have been updated as a preventative measure in the

event that a new attack vector for this issue is discovered.

(No CVE number)

Topics Covered

security advisory denial of service security issue Ubuntu system update DBus interprocess messaging

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  dbus                            1.10.10-1ubuntu1.1
  libdbus-1-3                     1.10.10-1ubuntu1.1

Ubuntu 16.04 LTS:
  dbus                            1.10.6-1ubuntu3.1
  libdbus-1-3                     1.10.6-1ubuntu3.1

Ubuntu 14.04 LTS:
  dbus                            1.6.18-0ubuntu4.4
  libdbus-1-3                     1.6.18-0ubuntu4.4

Ubuntu 12.04 LTS:
  dbus                            1.4.18-1ubuntu1.8
  libdbus-1-3                     1.4.18-1ubuntu1.8

After a standard system update you need to reboot your computer to make
all the necessary changes.