full-disclosure - [ MDVSA-2008:054 ] - Updated dbus packages fix vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-id: <E1JUqsR-0007I3-BE@artemis.annvix.ca>
Date: Thu, 28 Feb 2008 15:05:19 -0700
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2008:054 ] - Updated dbus packages fix
	vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDVSA-2008:054
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : dbus
 Date    : February 28, 2008
 Affected: 2007.0, 2007.1, 2008.0
 _______________________________________________________________________
 
 Problem Description:
 
 A vulnerability was discovered by Havoc Pennington in how the
 dbus-daemon applied its security policy.  A user with the ability
 to connect to the dbus-daemon could possibly execute certain method
 calls that they should not normally have access to.
 
 The updated packages have been patched to correct these issues.
 
 Users will have to reboot the system once these packages have been
 installed in order to prevent problems due to service dependencies
 on the messagebus service.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0595
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 5a7276c83f7f3ac5e2d8f26f3cf0fed9  2007.0/i586/dbus-0.92-8.3mdv2007.0.i586.rpm
 e97939d34bc7d3782bf8c5f54b6bca90  2007.0/i586/dbus-x11-0.92-8.3mdv2007.0.i586.rpm
 9163f5e8243bf78d88be99329ee5536e  2007.0/i586/libdbus-1_3-0.92-8.3mdv2007.0.i586.rpm
 dd9015731ae2557d7e0962204eedacc3  2007.0/i586/libdbus-1_3-devel-0.92-8.3mdv2007.0.i586.rpm 
 7e124dac56bfef6f1966cbc2f535fa7b  2007.0/SRPMS/dbus-0.92-8.3mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 79ace61e47f1dee7e62cfa2e7b1fd700  2007.0/x86_64/dbus-0.92-8.3mdv2007.0.x86_64.rpm
 422ee658a55a0b36f53be71965e6d890  2007.0/x86_64/dbus-x11-0.92-8.3mdv2007.0.x86_64.rpm
 e7126e8743aaa2994815eac7816ab1af  2007.0/x86_64/lib64dbus-1_3-0.92-8.3mdv2007.0.x86_64.rpm
 ff7a748f340acc367150b76bc96d9144  2007.0/x86_64/lib64dbus-1_3-devel-0.92-8.3mdv2007.0.x86_64.rpm 
 7e124dac56bfef6f1966cbc2f535fa7b  2007.0/SRPMS/dbus-0.92-8.3mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 c46891482cb070370be2c6157d6bef2f  2007.1/i586/dbus-1.0.2-5.1mdv2007.1.i586.rpm
 ce9017c03cf6da6c230813a17575e3ec  2007.1/i586/dbus-x11-1.0.2-5.1mdv2007.1.i586.rpm
 6c4101834728f802046b542f151b1610  2007.1/i586/libdbus-1_3-1.0.2-5.1mdv2007.1.i586.rpm
 77e621ee92730a2dc2cf1afa3767fb0f  2007.1/i586/libdbus-1_3-devel-1.0.2-5.1mdv2007.1.i586.rpm 
 871e7bf8eb42f738ea608498bb22c83d  2007.1/SRPMS/dbus-1.0.2-5.1mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 810876faa8ab66ad81208e478d1b6c66  2007.1/x86_64/dbus-1.0.2-5.1mdv2007.1.x86_64.rpm
 8264902b916bf8173254d409190e4521  2007.1/x86_64/dbus-x11-1.0.2-5.1mdv2007.1.x86_64.rpm
 9af9c3dafc670a714fccd436eb2f5f55  2007.1/x86_64/lib64dbus-1_3-1.0.2-5.1mdv2007.1.x86_64.rpm
 74eab3e48b81c4d28059e18d2f85c6cd  2007.1/x86_64/lib64dbus-1_3-devel-1.0.2-5.1mdv2007.1.x86_64.rpm 
 871e7bf8eb42f738ea608498bb22c83d  2007.1/SRPMS/dbus-1.0.2-5.1mdv2007.1.src.rpm

 Mandriva Linux 2008.0:
 8229d2b51c125547a97777820e2b1a07  2008.0/i586/dbus-1.0.2-10.1mdv2008.0.i586.rpm
 54cda1c75e70def572ad0863ff5906be  2008.0/i586/dbus-x11-1.0.2-10.1mdv2008.0.i586.rpm
 c0fe93aefc3fb7ba23c1fa094e514fb6  2008.0/i586/libdbus-1_3-1.0.2-10.1mdv2008.0.i586.rpm
 73faf4f17084c8d7649ae9a7ba2388a8  2008.0/i586/libdbus-1_3-devel-1.0.2-10.1mdv2008.0.i586.rpm 
 434db235c2a5c47a71da59419c47af6f  2008.0/SRPMS/dbus-1.0.2-10.1mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 bbd678498ca22dbc20f9c3a1e5070242  2008.0/x86_64/dbus-1.0.2-10.1mdv2008.0.x86_64.rpm
 91b3a599276bea83e65090250944c83c  2008.0/x86_64/dbus-x11-1.0.2-10.1mdv2008.0.x86_64.rpm
 d2e9804fbe492b9d00784c05e739f46d  2008.0/x86_64/lib64dbus-1_3-1.0.2-10.1mdv2008.0.x86_64.rpm
 0088a4965b25db33615eb7192dff7ddc  2008.0/x86_64/lib64dbus-1_3-devel-1.0.2-10.1mdv2008.0.x86_64.rpm 
 434db235c2a5c47a71da59419c47af6f  2008.0/SRPMS/dbus-1.0.2-10.1mdv2008.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFHxwVDmqjQ0CJFipgRAlScAJ966LnErJsKArKsfS1yz1cEldmHDwCeJAZR
3fSZdCJDeg1PV6q5CFGDGK8=
=kpoA
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/