Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute arbitrary SQL commands via vectors related to color devices and (a) device id, (b) property, or (c) profile id.

- Update to version 0.1.15 :

  + This release fixes an important security bug:
    CVE-2011-4349.

  + New Features :

  - Add a native driver for the Hughski ColorHug hardware

  - Export cd-math as three projects are now using it

  + Bugfixes :

  - Documentation fixes and improvements

  - Do not crash the daemon if adding the device to the db     failed

  - Do not match any sensor device with a kernel driver

  - Don't be obscure when the user passes a device-id to     colormgr

  - Fix a memory leak when getting properties from a device

  - Fix colormgr device-get-default-profile

  - Fix some conection bugs in colormgr

  - Fix some potential SQL injections

  - Make gusb optional

  - Only use the udev USB helper if the PID and VID have     matches

  - Output the Huey calibration matrices when dumping the     sensor

  - Changes from version 0.1.14 :

  + New Features :

  - Add defines for the i1 Display 3

  - Add two more DATA_source values to the specification

  - Align the output from colormgr get-devices and     get-profiles

  - Allow cd-fix-profile to append and edit new metadata

  + Bugfixes :

  - Ensure non-native device are added with no driver module

  - Split the sensor and device udev code

  + Updated translations.

  - Run the colord daemon as user colord :

  + Add colord-polkit-annotate-owner.patch: add     org.freedesktop.policykit.owner annotations to policy     file so that running as colord user works.

  + Add a %pre script to create the colord user.

  + Add pwdutils Requires(pre), to make sure we can create     the user.

  + Pass --with-daemon-user=colord to configure.

  + Package /var/lib/colord with the right user.

  + Add calls to autoreconf and intltoolize, as needed by     above patch.

It was discovered that colord incorrectly handled certain SQL queries.
A local attacker could exploit this to modify arbitrary sqlite databases. On Ubuntu, colord runs as its own user by default, so standard file permissions would limit which databases could be altered.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- New upstream version

    - This release fixes an important security bug:
      CVE-2011-4349.

    - Do not crash the daemon if adding the device to the db       failed

    - Fix a memory leak when getting properties from a       device

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- New rebased upstream version.

    - This release fixes an important security bug:
      CVE-2011-4349.

    - Do not crash the daemon if adding the device to the db       failed

    - Fix a memory leak when getting properties from a       device

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
74530	openSUSE Security Update : colord (openSUSE-2011-57)	Nessus	SuSE Local Security Checks	medium
57047	Ubuntu 11.10 : colord vulnerability (USN-1289-1)	Nessus	Ubuntu Local Security Checks	medium
57004	Fedora 16 : colord-0.1.15-1.fc16 (2011-16453)	Nessus	Fedora Local Security Checks	medium
57003	Fedora 15 : colord-0.1.15-1.fc15 (2011-16451)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-4349

high

Tenable Plugins

medium

medium

medium

medium