GLSA-201406-01 : D-Bus, GLib: Privilege escalation

This script is Copyright (C) 2014-2015 Tenable Network Security, Inc.


Synopsis :

The remote Gentoo host is missing one or more security-related
patches.

Description :

The remote host is affected by the vulnerability described in GLSA-201406-01
(D-Bus, GLib: Privilege escalation)

When libdbus is used in a setuid program, a user can gain escalated
privileges by leveraging the DBUS_SYSTEM_BUS_ADDRESS variable. GLib can
be used in a setuid context with D-Bus, and so can trigger this
vulnerability. Please review the CVE identifier below for more details.

Impact :

A local attacker could gain escalated privileges and execute arbitrary
code.

Workaround :

There is no known workaround at this time.

See also :

https://security.gentoo.org/glsa/201406-01

Solution :

All D-Bus users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=sys-apps/dbus-1.6.8'
All GLib users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=dev-libs/glib-2.32.4-r1'

Risk factor :

Medium / CVSS Base Score : 6.9
(CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 5.4
(CVSS2#E:POC/RL:OF/RC:C)
Public Exploit Available : true

Family: Gentoo Local Security Checks

Nessus Plugin ID: 74258 ()

Bugtraq ID: 55517

CVE ID: CVE-2012-3524

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now