Bug 60916 (CVE-2013-0292) - CVE-2013-0292: authentication bypass due to insufficient checks in dbus-glib < 0.100.1
Summary: CVE-2013-0292: authentication bypass due to insufficient checks in dbus-glib ...
Status: RESOLVED FIXED
Alias: CVE-2013-0292
Product: dbus
Classification: Unclassified
Component: GLib (show other bugs)
Version: unspecified
Hardware: Other All
: highest blocker
Assignee: Simon McVittie
QA Contact:
URL: http://cgit.freedesktop.org/dbus/dbus...
Whiteboard:
Keywords: patch, security
Depends on:
Blocks:
 
Reported: 2013-02-15 17:36 UTC by Simon McVittie
Modified: 2013-02-18 13:13 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:

Attachments

Description Simon McVittie 2013-02-15 17:36:12 UTC 
Copied from the advisory I just sent out:

Sebastian Krahmer discovered and published an authentication bypass
vulnerability in pam_fprintd, caused by a bug in dbus-glib. It is
possible that other users of dbus-glib can be exploited in the same
way. CVE-2013-0292 has been allocated for this vulnerability.

This vulnerability is fixed in dbus-glib version 0.100.1 by git commit
166978a. All users of dbus-glib should upgrade.

<http://dbus.freedesktop.org/releases/dbus-glib/dbus-glib-0.100.1.tar.gz>
<http://dbus.freedesktop.org/releases/dbus-glib/dbus-glib-0.100.1.tar.gz.asc>
<http://cgit.freedesktop.org/dbus/dbus-glib/commit/?id=166978a09cf5edff4028e670b6074215a4c75eca>

The D-Bus maintainers consider use of dbus-glib to be deprecated. We
encourage GLib application and library authors to switch to GDBus, which
has been part of GLib since 2.26.

Thanks to Sebastian Krahmer and Bastien Nocera for bringing this
vulnerability to our attention, and the Red Hat Security Response Team
for allocating a CVE ID.
Comment 1 Simon McVittie 2013-02-15 17:37:11 UTC 
This is fixed in the 0.100.1 point release, which has no other changes from 0.100.

It will also be fixed in 0.102 when that happens.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.