The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Add patch to fix (CVE-2013-0292)

  - Resolves: #913072

Sebastian Krahmer reports :

A privilege escalation flaw was found in the way dbus-glib, the D-Bus add-on library to integrate the standard D-Bus library with the GLib thread abstraction and main loop, performed filtering of the message sender (message source subject), when the NameOwnerChanged signal was received. A local attacker could use this flaw to escalate their privileges.

This update fixes :

  - Bug #911714 - CVE-2013-0292 dbus-glib: Local privilege     escalation due improper filtering of message sender when     NameOwnerChanged signal received [fedora-all]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2013:0568 :

Updated dbus-glib packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

dbus-glib is an add-on library to integrate the standard D-Bus library with the GLib main loop and threading model.

A flaw was found in the way dbus-glib filtered the message sender (message source subject) when the 'NameOwnerChanged' signal was received. This could trick a system service using dbus-glib (such as fprintd) into believing a signal was sent from a privileged process, when it was not. A local attacker could use this flaw to escalate their privileges. (CVE-2013-0292)

All dbus-glib users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications linked against dbus-glib, such as fprintd and NetworkManager, must be restarted for this update to take effect.

Updated dbus-glib packages fix security vulnerability :

A privilege escalation flaw was found in the way dbus-glib, the D-Bus add-on library to integrate the standard D-Bus library with the GLib thread abstraction and main loop, performed filtering of the message sender (message source subject), when the NameOwnerChanged signal was received. A local attacker could use this flaw to escalate their privileges (CVE-2013-0292).

A flaw was found in the way dbus-glib filtered the message sender (message source subject) when the 'NameOwnerChanged' signal was received. This could trick a system service using dbus-glib (such as fprintd) into believing a signal was sent from a privileged process, when it was not. A local attacker could use this flaw to escalate their privileges. (CVE-2013-0292)

All running applications linked against dbus-glib, such as fprintd and NetworkManager, must be restarted for this update to take effect.

Updated dbus-glib packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

dbus-glib is an add-on library to integrate the standard D-Bus library with the GLib main loop and threading model.

A flaw was found in the way dbus-glib filtered the message sender (message source subject) when the 'NameOwnerChanged' signal was received. This could trick a system service using dbus-glib (such as fprintd) into believing a signal was sent from a privileged process, when it was not. A local attacker could use this flaw to escalate their privileges. (CVE-2013-0292)

All dbus-glib users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications linked against dbus-glib, such as fprintd and NetworkManager, must be restarted for this update to take effect.

Sebastian Krahmer and Bastien Nocera discovered that DBus-GLib did not properly validate the message sender when the 'NameOwnerChanged' signal was received. A local attacker could possibly use this issue to escalate their privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
91741	OracleVM 3.2 : dbus-glib (OVMSA-2016-0057)	Nessus	OracleVM Local Security Checks	high
73550	FreeBSD : dbus-glib -- privledge escalation (77bb0541-c1aa-11e3-a5ac-001b21614864)	Nessus	FreeBSD Local Security Checks	high
68860	Fedora 18 : dbus-glib-0.100-3.fc18 (2013-12156)	Nessus	Fedora Local Security Checks	high
68765	Oracle Linux 5 / 6 : dbus-glib (ELSA-2013-0568)	Nessus	Oracle Linux Local Security Checks	high
67341	Fedora 19 : dbus-glib-0.100-5.fc19 (2013-12199)	Nessus	Fedora Local Security Checks	high
66085	Mandriva Linux Security Advisory : dbus-glib (MDVSA-2013:071)	Nessus	Mandriva Local Security Checks	high
64962	Scientific Linux Security Update : dbus-glib on SL5.x, SL6.x i386/x86_64 (20130226)	Nessus	Scientific Linux Local Security Checks	high
64939	CentOS 5 / 6 : dbus-glib (CESA-2013:0568)	Nessus	CentOS Local Security Checks	high
64929	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : dbus-glib vulnerability (USN-1753-1)	Nessus	Ubuntu Local Security Checks	high
64904	RHEL 5 / 6 : dbus-glib (RHSA-2013:0568)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2013-0292

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high