openSUSE Security Update : dbus-1 (openSUSE-SU-2014:1239-1)
Medium Nessus Plugin ID 77890
SynopsisThe remote openSUSE host is missing a security update.
DescriptionThe DBUS-1 service and libraries were updated to upstream release 1.6.24 fixing security issues and bugs.
Upstream changes since dbus 1.6.8
+ Security fixes
- Do not accept an extra fd in the padding of a cmsg message, which could lead to a 4-byte heap buffer overrun. (CVE-2014-3635, fdo#83622; Simon McVittie)
- Reduce default for maximum Unix file descriptors passed per message from 1024 to 16, preventing a uid with the default maximum number of connections from exhausting the system bus' file descriptors under Linux's default rlimit. Distributors or system administrators with a more restrictive fd limit may wish to reduce these limits further. Additionally, on Linux this prevents a second denial of service in which the dbus-daemon can be made to exceed the maximum number of fds per sendmsg() and disconnect the process that would have received them. (CVE-2014-3636, fdo#82820; Alban Crequy)
- Disconnect connections that still have a fd pending unmarshalling after a new configurable limit, pending_fd_timeout (defaulting to 150 seconds), removing the possibility of creating an abusive connection that cannot be disconnected by setting up a circular reference to a connection's file descriptor.
(CVE-2014-3637, fdo#80559; Alban Crequy)
- Reduce default for maximum pending replies per connection from 8192 to 128, mitigating an algorithmic complexity denial-of-service attack (CVE-2014-3638, fdo#81053; Alban Crequy)
- Reduce default for authentication timeout on the system bus from 30 seconds to 5 seconds, avoiding denial of service by using up all unauthenticated connection slots; and when all unauthenticated connection slots are used up, make new connection attempts block instead of disconnecting them. (CVE-2014-3639, fdo#80919; Alban Crequy)
- On Linux >= 2.6.37-rc4, if sendmsg() fails with ETOOMANYREFS, silently drop the message. This prevents an attack in which a malicious client can make dbus-daemon disconnect a system service, which is a local denial of service. (fdo#80163, CVE-2014-3532;
- Track remaining Unix file descriptors correctly when more than one message in quick succession contains fds.
This prevents another attack which a malicious client can make dbus-daemon disconnect a system service.
(fdo#79694, fdo#80469, CVE-2014-3533; Alejandro Martínez Suárez, Simon McVittie, Alban Crequy)
- Alban Crequy at Collabora Ltd. discovered and fixed a denial-of-service flaw in dbus-daemon, part of the reference implementation of D-Bus. Additionally, in highly unusual environments the same flaw could lead to a side channel between processes that should not be able to communicate. (CVE-2014-3477, fdo#78979)
- CVE-2013-2168: Fix misuse of va_list that could be used as a denial of service for system services.
Vulnerability reported by Alexandru Cornea. (Simon)
+ Other fixes
- Don't leak memory on out-of-memory while listing activatable or active services (fdo#71526, Radoslaw Pajak)
- fix undefined behaviour in a regression test (fdo#69924, DreamNik)
- path_namespace='/' in match rules incorrectly matched nothing; it now matches everything. (fdo#70799, Simon McVittie)
- Make dbus_connection_set_route_peer_messages(x, FALSE) behave as documented. Previously, it assumed its second parameter was TRUE. (fdo#69165, Chengwei Yang)
- Fix a NULL pointer dereference on an unlikely error path (fdo#69327, Sviatoslav Chagaev)
- If accept4() fails with EINVAL, as it can on older Linux kernels with newer glibc, try accept() instead of going into a busy-loop. (fdo#69026, Chengwei Yang)
- If socket() or socketpair() fails with EINVAL or EPROTOTYPE, for instance on Hurd or older Linux with a new glibc, try without SOCK_CLOEXEC. (fdo#69073; Pino Toscano, Chengwei Yang)
- Fix a file descriptor leak on an error code path.
(fdo#69182, Sviatoslav Chagaev)
- Fix compilation if writev() is unavailable (fdo#69409, Vasiliy Balyasnyy)
- Avoid an infinite busy-loop if a signal interrupts waitpid() (fdo#68945, Simon McVittie)
- Escape addresses containing non-ASCII characters correctly (fdo#53499, Chengwei Yang)
- If malloc() returns NULL in _dbus_string_init() or similar, don't free an invalid pointer if the string is later freed (fdo#65959, Chengwei Yang)
- If malloc() returns NULL in dbus_set_error(), don't va_end() a va_list that was never va_start()ed (fdo#66300, Chengwei Yang)
- Fix a regression test on platforms with strict alignment (fdo#67279, Colin Walters)
- Avoid calling function parameters 'interface' since certain Windows headers have a namespace-polluting macro of that name (fdo#66493, Ivan Romanov)
- Make 'make -j check' work (fdo#68852, Simon McVittie)
- In dbus-daemon, don't crash if a .service file starts with key=value (fdo#60853, Chengwei Yang)
- Fix an assertion failure if we try to activate systemd services before systemd connects to the bus (fdo#50199, Chengwei Yang)
- Avoid compiler warnings for ignoring the return from write() (Chengwei Yang)
- Following Unicode Corrigendum #9, the noncharacters U+nFFFE, U+nFFFF, U+FDD0..U+FDEF are allowed in UTF-8 strings again. (fdo#63072, Simon McVittie)
- Diagnose incorrect use of dbus_connection_get_data() with negative slot (i.e. before allocating the slot) rather than returning junk (fdo#63127, Dan Williams)
- In the activation helper, when compiled for tests, do not reset the system bus address, fixing the regression tests. (fdo#52202, Simon)
- Fix building with Valgrind 3.8, at the cost of causing harmless warnings with Valgrind 3.6 on some compilers (fdo#55932, Arun Raghavan)
- Don't leak temporary fds pointing to /dev/null (fdo#56927, Michel HERMIER)
- Create session.d, system.d directories under CMake (fdo#41319, Ralf Habacker)
- Include alloca.h for alloca() if available, fixing compilation on Solaris 10 (fdo#63071, Dagobert Michelsen)
SolutionUpdate the affected dbus-1 packages.