Hi,
please consider unblocking dbus 1.2.1-4.
It fixes #501443 (a security bug), #502408 and #470121.
The Debian changelog is:
dbus (1.2.1-4) unstable; urgency=high
* debian/patches/CVE-2008-3834.patch
- The dbus_signature_validate function in the D-bus library allows
attackers to cause a denial of service (application abort) via a
message
containing a malformed signature, which triggers a failed assertion
error. (Closes: #501443)
Fixes: CVE-2008-3834
- Urgency high for the security fix.
* debian/patches/20-dbus-alpha-unaligned.patch
- Fix misaligned memory access which causes "unaligned traps" on Alpha.
(Closes: #502408)
* debian/dbus.init
- Add "status" action to init script. (Closes: #470121)
* debian/control
- Bump Depends on lsb-base to >= 3.2-14, which provides
status_of_proc().
-- Michael Biebl <biebl@debian.org> Sat, 25 Oct 2008 15:28:05 +0200
The complete debdiff and diffstat is attached
Thanks for considering,
Michael
--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?
changelog | 19 +++++++++++++++++++
control | 2 +-
dbus.init | 5 ++++-
patches/20-dbus-alpha-unaligned.patch | 11 +++++++++++
patches/CVE-2008-3834.patch | 25 +++++++++++++++++++++++++
5 files changed, 60 insertions(+), 2 deletions(-)
Index: debian/control
===================================================================
--- debian/control (.../1.2.1-3) (Revision 2498)
+++ debian/control (.../1.2.1-4) (Revision 2498)
@@ -27,7 +27,7 @@
${misc:Depends},
adduser,
debianutils (>= 1.22.0),
- lsb-base (>= 3.1)
+ lsb-base (>= 3.2-14)
Conflicts: libdbus0,
dbus-1,
dbus-1-utils (<< 1.0.2-5),
Index: debian/changelog
===================================================================
--- debian/changelog (.../1.2.1-3) (Revision 2498)
+++ debian/changelog (.../1.2.1-4) (Revision 2498)
@@ -1,3 +1,22 @@
+dbus (1.2.1-4) unstable; urgency=high
+
+ * debian/patches/CVE-2008-3834.patch
+ - The dbus_signature_validate function in the D-bus library allows
+ attackers to cause a denial of service (application abort) via a message
+ containing a malformed signature, which triggers a failed assertion
+ error. (Closes: #501443)
+ Fixes: CVE-2008-3834
+ - Urgency high for the security fix.
+ * debian/patches/20-dbus-alpha-unaligned.patch
+ - Fix misaligned memory access which causes "unaligned traps" on Alpha.
+ (Closes: #502408)
+ * debian/dbus.init
+ - Add "status" action to init script. (Closes: #470121)
+ * debian/control
+ - Bump Depends on lsb-base to >= 3.2-14, which provides status_of_proc().
+
+ -- Michael Biebl <biebl@debian.org> Sat, 25 Oct 2008 15:28:05 +0200
+
dbus (1.2.1-3) unstable; urgency=low
* debian/patches/15_dbus_group_parsing.patch
Index: debian/patches/20-dbus-alpha-unaligned.patch
===================================================================
--- debian/patches/20-dbus-alpha-unaligned.patch (.../1.2.1-3) (Revision 0)
+++ debian/patches/20-dbus-alpha-unaligned.patch (.../1.2.1-4) (Revision 2498)
@@ -0,0 +1,11 @@
+--- a/dbus/dbus-marshal-basic.c.ORIG 2008-04-23 17:54:58.000000000 -0400
++++ b/dbus/dbus-marshal-basic.c 2008-04-23 18:00:06.000000000 -0400
+@@ -518,7 +518,7 @@ _dbus_marshal_read_basic (const DBusStri
+ switch (type)
+ {
+ case DBUS_TYPE_BYTE:
+- vp->byt = _dbus_string_get_byte (str, pos);
++ *((volatile char *)&vp->byt) = _dbus_string_get_byte (str, pos);
+ (pos)++;
+ break;
+ case DBUS_TYPE_INT16:
Index: debian/patches/CVE-2008-3834.patch
===================================================================
--- debian/patches/CVE-2008-3834.patch (.../1.2.1-3) (Revision 0)
+++ debian/patches/CVE-2008-3834.patch (.../1.2.1-4) (Revision 2498)
@@ -0,0 +1,25 @@
+diff --git a/dbus/dbus-marshal-validate-util.c b/dbus/dbus-marshal-validate-util.c
+index f2901d7..5365d6d 100644
+--- a/dbus/dbus-marshal-validate-util.c
++++ dbus-1.0.2/dbus/dbus-marshal-validate-util.c
+@@ -228,6 +228,7 @@ _dbus_marshal_validate_test (void)
+ "123",
+ ".",
+ "("
++ "a{(ii)i}" /* https://bugs.freedesktop.org/show_bug.cgi?id=17803 */
+ };
+
+ /* Signature with reason */
+diff --git a/dbus/dbus-marshal-validate.c b/dbus/dbus-marshal-validate.c
+index e63a463..b24b5bc 100644
+--- a/dbus/dbus-marshal-validate.c
++++ dbus-1.0.2/dbus/dbus-marshal-validate.c
+@@ -247,6 +247,7 @@ _dbus_validate_signature_with_reason (const DBusString *type_str,
+ }
+
+ if (last == DBUS_DICT_ENTRY_BEGIN_CHAR &&
++ _dbus_type_is_valid (*p) &&
+ !dbus_type_is_basic (*p))
+ {
+ result = DBUS_INVALID_DICT_KEY_MUST_BE_BASIC_TYPE;
+
Index: debian/dbus.init
===================================================================
--- debian/dbus.init (.../1.2.1-3) (Revision 2498)
+++ debian/dbus.init (.../1.2.1-4) (Revision 2498)
@@ -170,8 +170,11 @@
shut_it_down
start_it_up
;;
+ status)
+ status_of_proc -p $PIDFILE $DAEMON $NAME && exit 0 || exit $?
+ ;;
*)
- echo "Usage: /etc/init.d/$NAME {start|stop|reload|restart|force-reload}" >&2
+ echo "Usage: /etc/init.d/$NAME {start|stop|reload|restart|force-reload|status}" >&2
exit 2
;;
esac
Attachment:
signature.asc
Description: OpenPGP digital signature