CVE-2012-3524: Medium severity Freedesktop libdbus vulnerability
libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUSSYSTEMBUSADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."
Other sources
X.org has traditionally been suid root so that users could utilize "startx" (or similar scripts) to start X from the command line as a user. X.org does not sanitize the environment when starting, which means it will be aware of, and pass along, environment variables. When X.org is using the DBus backend, specifically versions 1.5.x or newer, the DBUSSYSTEMBUSADDRESS environment variable is passed along to libdbus. The DBUS system address can take a unixexec (Executed Subprocess on UNIX) transport [1] which allows one to specify a binary to execute and arguments to pass to it.
Because the DBUSSYSTEMBUSADDRESS environment variable is not scrubbed by X, this environment variable is passed along to libdbus, and it specifies the address of the system message bus. A malicious local user could use this, in conjunction with the unixexec transport, to execute arbitrary code as root (because /usr/bin/Xorg is suid root).
[1] http://dbus.freedesktop.org/doc/dbus-specification.html#transports-exec
Acknowledgements:
Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for reporting this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3524?
CVE-2012-3524 is classified as a high severity vulnerability that allows local users to gain privileges and execute arbitrary code.
How do I fix CVE-2012-3524?
To fix CVE-2012-3524, update libdbus to version 1.5.14 or later, which contains the necessary security patches.
What versions of libdbus are affected by CVE-2012-3524?
CVE-2012-3524 affects libdbus versions 1.5.x and earlier, including 1.5.0 through 1.5.12.
Can this vulnerability be exploited remotely?
CVE-2012-3524 is a local privilege escalation vulnerability and cannot be exploited remotely.
What impact does CVE-2012-3524 have on my system?
The impact of CVE-2012-3524 includes unauthorized privilege escalation, potentially allowing an attacker to execute arbitrary code with elevated privileges.