The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.

dbus-1 was updated to version 1.8.16 to fix one security issue.

This update fixes the following security issue :

  - CVE-2015-0245: Do not allow non-uid-0 processes to send     forged ActivationFailure messages. On Linux systems with     systemd activation, this would allow a local denial of     service (bnc#916343).

These additional security hardenings are included :

  - Do not allow calls to UpdateActivationEnvironment from     uids other than the uid of the dbus-daemon. If a system     service installs unsafe security policy rules that allow     arbitrary method calls (such as CVE-2014-8148) then this     prevents memory consumption and possible privilege     escalation via UpdateActivationEnvironment.

  - Do not allow calls to UpdateActivationEnvironment or the     Stats interface on object paths other than     /org/freedesktop/DBus. Some system services install     unsafe security policy rules that allow arbitrary method     calls to any destination, method and interface with a     specified object path.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

dbus-1, dbus-1-x11 were updated to version 1.8.16 to fix one security issue.

This update fixes the following security issue :

  - CVE-2015-0245: Do not allow non-uid-0 processes to send     forged ActivationFailure messages. On Linux systems with     systemd activation, this would allow a local denial of     service (bnc#916343).

These additional security hardenings are included :

  - Do not allow calls to UpdateActivationEnvironment from     uids other than the uid of the dbus-daemon. If a system     service installs unsafe security policy rules that allow     arbitrary method calls (such as CVE-2014-8148) then this     prevents memory consumption and possible privilege     escalation via UpdateActivationEnvironment.

  - Do not allow calls to UpdateActivationEnvironment or the     Stats interface on object paths other than     /org/freedesktop/DBus. Some system services install     unsafe security policy rules that allow arbitrary method     calls to any destination, method and interface with a     specified object path.

This update fixes the following security issues :

  - CVE-2014-8148 :

  - Do not allow calls to UpdateActivationEnvironment from     uids other than the uid of the dbus-daemon. If a system     service installs unsafe security policy rules that allow     arbitrary method calls (such as CVE-2014-8148) then this     prevents memory consumption and possible privilege     escalation via UpdateActivationEnvironment.

  - CVE-2012-3524: Don't access environment variables     (bnc#912016)

ID	Name	Product	Family	Severity
83693	SUSE SLED12 / SLES12 Security Update : dbus-1 (SUSE-SU-2015:0457-1)	Nessus	SuSE Local Security Checks	high
81397	openSUSE Security Update : dbus-1 / dbus-1-x11 (openSUSE-2015-150)	Nessus	SuSE Local Security Checks	high
80985	openSUSE Security Update : dbus-1 (openSUSE-SU-2015:0111-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2014-8148

high

Tenable Plugins

high

high

high