openSUSE Security Update : dbus-1 (openSUSE-SU-2014:1239-1)

medium Nessus Plugin ID 77890

Language:

Synopsis

The remote openSUSE host is missing a security update.

Description

The DBUS-1 service and libraries were updated to upstream release 1.6.24 fixing security issues and bugs.

Upstream changes since dbus 1.6.8

+ Security fixes

- Do not accept an extra fd in the padding of a cmsg message, which could lead to a 4-byte heap buffer overrun. (CVE-2014-3635, fdo#83622; Simon McVittie)

- Reduce default for maximum Unix file descriptors passed per message from 1024 to 16, preventing a uid with the default maximum number of connections from exhausting the system bus' file descriptors under Linux's default rlimit. Distributors or system administrators with a more restrictive fd limit may wish to reduce these limits further. Additionally, on Linux this prevents a second denial of service in which the dbus-daemon can be made to exceed the maximum number of fds per sendmsg() and disconnect the process that would have received them. (CVE-2014-3636, fdo#82820; Alban Crequy)

- Disconnect connections that still have a fd pending unmarshalling after a new configurable limit, pending_fd_timeout (defaulting to 150 seconds), removing the possibility of creating an abusive connection that cannot be disconnected by setting up a circular reference to a connection's file descriptor.
(CVE-2014-3637, fdo#80559; Alban Crequy)

- Reduce default for maximum pending replies per connection from 8192 to 128, mitigating an algorithmic complexity denial-of-service attack (CVE-2014-3638, fdo#81053; Alban Crequy)

- Reduce default for authentication timeout on the system bus from 30 seconds to 5 seconds, avoiding denial of service by using up all unauthenticated connection slots; and when all unauthenticated connection slots are used up, make new connection attempts block instead of disconnecting them. (CVE-2014-3639, fdo#80919; Alban Crequy)

- On Linux >= 2.6.37-rc4, if sendmsg() fails with ETOOMANYREFS, silently drop the message. This prevents an attack in which a malicious client can make dbus-daemon disconnect a system service, which is a local denial of service. (fdo#80163, CVE-2014-3532;
Alban Crequy)

- Track remaining Unix file descriptors correctly when more than one message in quick succession contains fds.
This prevents another attack which a malicious client can make dbus-daemon disconnect a system service.
(fdo#79694, fdo#80469, CVE-2014-3533; Alejandro Martínez Suárez, Simon McVittie, Alban Crequy)

- Alban Crequy at Collabora Ltd. discovered and fixed a denial-of-service flaw in dbus-daemon, part of the reference implementation of D-Bus. Additionally, in highly unusual environments the same flaw could lead to a side channel between processes that should not be able to communicate. (CVE-2014-3477, fdo#78979)

- CVE-2013-2168: Fix misuse of va_list that could be used as a denial of service for system services.
Vulnerability reported by Alexandru Cornea. (Simon)

+ Other fixes

- Don't leak memory on out-of-memory while listing activatable or active services (fdo#71526, Radoslaw Pajak)

- fix undefined behaviour in a regression test (fdo#69924, DreamNik)

- path_namespace='/' in match rules incorrectly matched nothing; it now matches everything. (fdo#70799, Simon McVittie)

- Make dbus_connection_set_route_peer_messages(x, FALSE) behave as documented. Previously, it assumed its second parameter was TRUE. (fdo#69165, Chengwei Yang)

- Fix a NULL pointer dereference on an unlikely error path (fdo#69327, Sviatoslav Chagaev)

- If accept4() fails with EINVAL, as it can on older Linux kernels with newer glibc, try accept() instead of going into a busy-loop. (fdo#69026, Chengwei Yang)

- If socket() or socketpair() fails with EINVAL or EPROTOTYPE, for instance on Hurd or older Linux with a new glibc, try without SOCK_CLOEXEC. (fdo#69073; Pino Toscano, Chengwei Yang)

- Fix a file descriptor leak on an error code path.
(fdo#69182, Sviatoslav Chagaev)

- Fix compilation if writev() is unavailable (fdo#69409, Vasiliy Balyasnyy)

- Avoid an infinite busy-loop if a signal interrupts waitpid() (fdo#68945, Simon McVittie)

- Escape addresses containing non-ASCII characters correctly (fdo#53499, Chengwei Yang)

- If malloc() returns NULL in _dbus_string_init() or similar, don't free an invalid pointer if the string is later freed (fdo#65959, Chengwei Yang)

- If malloc() returns NULL in dbus_set_error(), don't va_end() a va_list that was never va_start()ed (fdo#66300, Chengwei Yang)

- Fix a regression test on platforms with strict alignment (fdo#67279, Colin Walters)

- Avoid calling function parameters 'interface' since certain Windows headers have a namespace-polluting macro of that name (fdo#66493, Ivan Romanov)

- Make 'make -j check' work (fdo#68852, Simon McVittie)

- In dbus-daemon, don't crash if a .service file starts with key=value (fdo#60853, Chengwei Yang)

- Fix an assertion failure if we try to activate systemd services before systemd connects to the bus (fdo#50199, Chengwei Yang)

- Avoid compiler warnings for ignoring the return from write() (Chengwei Yang)

- Following Unicode Corrigendum #9, the noncharacters U+nFFFE, U+nFFFF, U+FDD0..U+FDEF are allowed in UTF-8 strings again. (fdo#63072, Simon McVittie)

- Diagnose incorrect use of dbus_connection_get_data() with negative slot (i.e. before allocating the slot) rather than returning junk (fdo#63127, Dan Williams)

- In the activation helper, when compiled for tests, do not reset the system bus address, fixing the regression tests. (fdo#52202, Simon)

- Fix building with Valgrind 3.8, at the cost of causing harmless warnings with Valgrind 3.6 on some compilers (fdo#55932, Arun Raghavan)

- Don't leak temporary fds pointing to /dev/null (fdo#56927, Michel HERMIER)

- Create session.d, system.d directories under CMake (fdo#41319, Ralf Habacker)

- Include alloca.h for alloca() if available, fixing compilation on Solaris 10 (fdo#63071, Dagobert Michelsen)

Solution

Update the affected dbus-1 packages.

Plugin Details

Severity: Medium

ID: 77890

File Name: openSUSE-2014-557.nasl

Version: 1.6

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 9/26/2014

Updated: 1/19/2021

Supported Sensors: Frictionless Assessment Azure, Nessus Agent, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

CVSS v2

Risk Factor: Medium

Base Score: 4.4

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:dbus-1-x11, p-cpe:/a:novell:opensuse:libdbus-1-3, p-cpe:/a:novell:opensuse:dbus-1-devel, p-cpe:/a:novell:opensuse:dbus-1-debugsource, p-cpe:/a:novell:opensuse:libdbus-1-3-debuginfo-32bit, cpe:/o:novell:opensuse:12.3, p-cpe:/a:novell:opensuse:dbus-1-debuginfo-32bit, p-cpe:/a:novell:opensuse:dbus-1-x11-debuginfo, p-cpe:/a:novell:opensuse:dbus-1-x11-debugsource, p-cpe:/a:novell:opensuse:libdbus-1-3-32bit, p-cpe:/a:novell:opensuse:dbus-1-debuginfo, p-cpe:/a:novell:opensuse:dbus-1-32bit, p-cpe:/a:novell:opensuse:libdbus-1-3-debuginfo, p-cpe:/a:novell:opensuse:dbus-1, p-cpe:/a:novell:opensuse:dbus-1-devel-32bit

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 9/17/2014

Reference Information

CVE: CVE-2013-2168, CVE-2014-3477, CVE-2014-3532, CVE-2014-3533, CVE-2014-3635, CVE-2014-3636, CVE-2014-3637, CVE-2014-3638, CVE-2014-3639

Detections

Analytics