CVE-2012-3524
First published: Fri Aug 10 2012(Updated: )
X.org has traditionally been suid root so that users could utilize "startx" (or similar scripts) to start X from the command line as a user. X.org does not sanitize the environment when starting, which means it will be aware of, and pass along, environment variables. When X.org is using the DBus backend, specifically versions 1.5.x or newer, the DBUS_SYSTEM_BUS_ADDRESS environment variable is passed along to libdbus. The DBUS system address can take a unixexec (Executed Subprocess on UNIX) transport [1] which allows one to specify a binary to execute and arguments to pass to it. Because the DBUS_SYSTEM_BUS_ADDRESS environment variable is not scrubbed by X, this environment variable is passed along to libdbus, and it specifies the address of the system message bus. A malicious local user could use this, in conjunction with the unixexec transport, to execute arbitrary code as root (because /usr/bin/Xorg is suid root). [1] <a href="http://dbus.freedesktop.org/doc/dbus-specification.html#transports-exec">http://dbus.freedesktop.org/doc/dbus-specification.html#transports-exec</a> Acknowledgements: Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for reporting this issue.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Freedesktop Libdbus | <=1.5.12 | |
| Freedesktop Libdbus | =1.5.0 | |
| Freedesktop Libdbus | =1.5.2 | |
| Freedesktop Libdbus | =1.5.4 | |
| Freedesktop Libdbus | =1.5.6 | |
| Freedesktop Libdbus | =1.5.8 | |
| Freedesktop Libdbus | =1.5.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00000.html
- http://lists.opensuse.org/opensuse-updates/2012-10/msg00094.html
- http://rhn.redhat.com/errata/RHSA-2012-1261.html
- http://secunia.com/advisories/50537
- http://secunia.com/advisories/50544
- http://secunia.com/advisories/50710
- http://stealth.openwall.net/null/dzug.c
- http://www.exploit-db.com/exploits/21323
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:070
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:083
- http://www.openwall.com/lists/oss-security/2012/07/10/4
- http://www.openwall.com/lists/oss-security/2012/07/26/1
- http://www.openwall.com/lists/oss-security/2012/09/12/6
- http://www.openwall.com/lists/oss-security/2012/09/14/2
- http://www.openwall.com/lists/oss-security/2012/09/17/2
- http://www.securityfocus.com/bid/55517
- http://www.ubuntu.com/usn/USN-1576-1
- http://www.ubuntu.com/usn/USN-1576-2
- https://bugs.freedesktop.org/show_bug.cgi?id=52202
- https://bugzilla.novell.com/show_bug.cgi?id=697105
- https://bugzilla.redhat.com/show_bug.cgi?id=847402
- http://dbus.freedesktop.org/doc/dbus-specification.html#transports-exec
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=847402#c0
- http://cgit.freedesktop.org/xorg/xserver/tree/os/utils.c?id=7f09126e068015db54c56bb982b8f91065375700#n1744
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=606063&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=606063&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=606064&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=606064&action=edit
- http://www.openwall.com/lists/owl-dev/2012/08/14/1
- http://osdir.com/ml/linux.lfs.hardened/2007-04/msg00031.html
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=606084&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=606084&action=edit
- https://access.redhat.com/security/cve/CVE-2012-3524
- http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=conjunction
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=606355&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=606355&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=606392&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=606392&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=847402#c20
- http://sourceware.org/glibc/wiki/Tips_and_Tricks/secure_getenv
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=847402#c28
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=847402#c39
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=847402#c13
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=847402#c17
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=847402#c51
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=847402#c50
- https://rhn.redhat.com/errata/RHSA-2012-1261.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=857226
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=847402#c65
- http://cgit.freedesktop.org/dbus/dbus/commit/?id=f68dbdc3e6f895012ce33939fb524accf31bcca5
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- collector/redhat-bugzilla
- alias/CVE-2012-3524
- vendor/freedesktop
- canonical/freedesktop libdbus
- version/freedesktop libdbus/1.5.12
- version/freedesktop libdbus/1.5.0
- version/freedesktop libdbus/1.5.2
- version/freedesktop libdbus/1.5.4
- version/freedesktop libdbus/1.5.6
- version/freedesktop libdbus/1.5.8
- version/freedesktop libdbus/1.5.10