libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.

The remote host is affected by the vulnerability described in GLSA-201406-29 (spice-gtk: Privilege escalation)

    spice-gtk does not properly sanitize the DBUS_SYSTEM_BUS_ADDRESS       environment variable.
  Impact :

    A local attacker may be able to gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

From Red Hat Security Advisory 2012:1284 :

Updated spice-gtk packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The spice-gtk packages provide a GIMP Toolkit (GTK+) widget for SPICE (Simple Protocol for Independent Computing Environments) clients. Both Virtual Machine Manager and Virtual Machine Viewer can make use of this widget to access virtual machines using the SPICE protocol.

It was discovered that the spice-gtk setuid helper application, spice-client-glib-usb-acl-helper, did not clear the environment variables read by the libraries it uses. A local attacker could possibly use this flaw to escalate their privileges by setting specific environment variables before running the helper application.
(CVE-2012-4425)

Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for reporting this issue.

All users of spice-gtk are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

Fix CVE-2012-4425

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for CVE-2012-4425

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated spice-gtk packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The spice-gtk packages provide a GIMP Toolkit (GTK+) widget for SPICE (Simple Protocol for Independent Computing Environments) clients. Both Virtual Machine Manager and Virtual Machine Viewer can make use of this widget to access virtual machines using the SPICE protocol.

It was discovered that the spice-gtk setuid helper application, spice-client-glib-usb-acl-helper, did not clear the environment variables read by the libraries it uses. A local attacker could possibly use this flaw to escalate their privileges by setting specific environment variables before running the helper application.
(CVE-2012-4425)

Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for reporting this issue.

All users of spice-gtk are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

The spice-gtk packages provide a GIMP Toolkit (GTK+) widget for SPICE (Simple Protocol for Independent Computing Environments) clients. Both Virtual Machine Manager and Virtual Machine Viewer can make use of this widget to access virtual machines using the SPICE protocol.

It was discovered that the spice-gtk setuid helper application, spice-client-glib-usb-acl-helper, did not clear the environment variables read by the libraries it uses. A local attacker could possibly use this flaw to escalate their privileges by setting specific environment variables before running the helper application.
(CVE-2012-4425)

All users of spice-gtk are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

To resolve dependencies gtk2, libcacard, libusb1, and spice-protocol have been added to the necessary repositories.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1284 advisory.

    The spice-gtk packages provide a GIMP Toolkit (GTK+) widget for SPICE     (Simple Protocol for Independent Computing Environments) clients. Both     Virtual Machine Manager and Virtual Machine Viewer can make use of this     widget to access virtual machines using the SPICE protocol.

    It was discovered that the spice-gtk setuid helper application,     spice-client-glib-usb-acl-helper, did not clear the environment variables     read by the libraries it uses. A local attacker could possibly use this     flaw to escalate their privileges by setting specific environment variables     before running the helper application. (CVE-2012-4425)

    Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for     reporting this issue.

    All users of spice-gtk are advised to upgrade to these updated packages,     which contain a backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update qemu / spice packages to their latest upstream releases :

  - qemu-1.2.0

    - spice-0.11.3

    - spice-protocol-0.12.1

    - spice-gtk-0.13.29

    - usbredir-0.5

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
76273	GLSA-201406-29 : spice-gtk: Privilege escalation	Nessus	Gentoo Local Security Checks	medium
68628	Oracle Linux 6 : spice-gtk (ELSA-2012-1284)	Nessus	Oracle Linux Local Security Checks	medium
62418	Fedora 16 : spice-gtk-0.11-5.fc16 (2012-14046)	Nessus	Fedora Local Security Checks	medium
62331	Fedora 17 : spice-gtk-0.12-5.fc17 (2012-14107)	Nessus	Fedora Local Security Checks	medium
62187	CentOS 6 : spice-gtk (CESA-2012:1284)	Nessus	CentOS Local Security Checks	medium
62175	Scientific Linux Security Update : spice-gtk on SL6.x i386/x86_64 (20120917)	Nessus	Scientific Linux Local Security Checks	medium
62170	RHEL 6 : spice-gtk (RHSA-2012:1284)	Nessus	Red Hat Local Security Checks	high
62157	Fedora 18 : qemu-1.2.0-3.fc18 / spice-0.11.3-1.fc18 / spice-gtk-0.13.29-4.fc18 / etc (2012-13513)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-4425

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

medium