libdbus CVE-2012-3524 fix

[Sebastian Krahmer <krahmer () suse de>]

Hi,

As the CRD is today, and list policy requires "opening" the
distros-list posting, here is the forward.

As a quick fix, the exploit can also be mitigated by properly
placing the dbus-launch binary into the expected path, usually
"/bin/dbus-launch", e.g.

# ln -s /usr/bin/dbus-launch /bin/dbus-launch

since for some reason, on most dists the binary is mis-placed
into /usr/bin. This makes an execv() fail in libdbus itself,
triggering an execvp().

Sebastian

----- Forwarded message from Sebastian Krahmer <krahmer () suse de> -----


Hi,

The recently discussed libdbus getenv() issue [1] turned out
to be easily exploitable on various UNIX systems, including
some Linux distributions. Common attack vectors are Xorg and
spice-gtk via auto-launching [2].
Properly patching requires fixes for libdbus and libgio,
depending on which you link your suid binaries.
Would be nice if someone from RH could forward their patch,
as they have some developers upstream and possibly access to
the private git commit (they also already assigned this CVE).
My CRD proposal is Sept. 12th. As can be seen in [1], this issue
is indeed public since 1+ year.

Sebastian

[1] https://bugzilla.novell.com/show_bug.cgi?id=697105
[2] http://stealth.openwall.net/null/dzug.c

PS: This is a re-send, the first mail to distros list was probably
catched by spam filter.

-- 

~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer () suse de - SuSE Security Team

---
SUSE LINUX Products GmbH,
GF: Jeff Hawn, Jennifer Guild, Felix Imend?rffer, HRB 16746 (AG N?rnberg)
Maxfeldstra?e 5
90409 N?rnberg
Germany



----- End forwarded message -----

-- 

~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer () suse de - SuSE Security Team