Bug#689602: pu: package dbus/1.2.24-4+squeeze2

["Adam D. Barratt" <adam@adam-barratt.org.uk>]

On Thu, 2012-10-04 at 13:56 +0100, Simon McVittie wrote:
> CVE-2012-3524 (#689070) is a local root privilege escalation vulnerability
> when setuid-root applications use libdbus without first sanitizing their
> caller-supplied environment via a whitelist. Applications thought to be
> exploitable include Xorg via the setuid /usr/bin/X if using libhal (so for us,
> kFreeBSD but not Linux), and perhaps su/sudo if libpam-systemd or
> libpam-ck-connector is used. I wasn't able to exploit libpam-ck-connector
> under a squeeze VM, but perhaps I'm doing it wrong.
> 
> D-Bus upstream consensus is that it is an application bug to use any
> non-trivial library in a setuid application without first clearing the
> caller-supplied environment; but having said that, hardening libdbus
> against applications with this bug seems wise.

Apologies for the delay in getting back to you about this. Judging from
the upload history, it looks like applying the patches to unstable /
testing was happily uneventful in terms of any issues arising in
applications?

Regards,

Adam