Opened 6 years ago

Closed 6 years ago

Last modified 5 years ago

#8891 closed enhancement (fixed)

dbus-1.10.16

Reported by: Douglas R. Reno Owned by: DJ Lucas
Priority: normal Milestone: 8.1
Component: BOOK Version: SVN
Severity: normal Keywords:
Cc:

Description

There is a new version of D-Bus, but the vulnerabilities that it fixes, as described by the maintainer, are non-practical. Let's leave this one at 8.1 since I just tagged it.

Change History (7)

comment:1 by Douglas R. Reno, 6 years ago

Owner: changed from blfs-book@… to Douglas R. Reno
Status: newassigned

comment:2 by Douglas R. Reno, 6 years ago

Summary: dbus-1.10.16 (Leave in 8.1)dbus-1.10.16
Enhancements:

• Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)

Fixes:

• Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.

  On Unix systems we strongly recommend using only the unix: and systemd:
  transports, together with EXTERNAL authentication. These are the only
  transports and authentication mechanisms enabled by default.

  (fd.o #99828, Simon McVittie)

• Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie)

comment:3 by DJ Lucas, 6 years ago

Owner: changed from Douglas R. Reno to DJ Lucas
Status: assignednew

comment:4 by DJ Lucas, 6 years ago

Status: newassigned

comment:5 by DJ Lucas, 6 years ago

Resolution: fixed
Status: assignedclosed

Resolved at r18466.

comment:6 by bdubbs@…, 5 years ago

Milestone: 8.1m8.1

Milestone renamed

comment:7 by bdubbs@…, 5 years ago

Milestone: m8.18.1

Milestone renamed

Note: See TracTickets for help on using tickets.