Security update for dbus-1 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0457-1 Final 1 1 2015-03-04T01:08:46Z current 2015-03-04T01:08:46Z 2015-03-04T01:08:46Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for dbus-1 dbus-1 was updated to version 1.8.16 to fix one security issue. This update fixes the following security issue: - CVE-2015-0245: Do not allow non-uid-0 processes to send forged ActivationFailure messages. On Linux systems with systemd activation, this would allow a local denial of service (bnc#916343). These additional security hardenings are included: - Do not allow calls to UpdateActivationEnvironment from uids other than the uid of the dbus-daemon. If a system service installs unsafe security policy rules that allow arbitrary method calls (such as CVE-2014-8148) then this prevents memory consumption and possible privilege escalation via UpdateActivationEnvironment. - Do not allow calls to UpdateActivationEnvironment or the Stats interface on object paths other than /org/freedesktop/DBus. Some system services install unsafe security policy rules that allow arbitrary method calls to any destination, method and interface with a specified object path. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-112,SUSE-SLE-SDK-12-2015-112,SUSE-SLE-SERVER-12-2015-112 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150457-1/ Link for SUSE-SU-2015:0457-1 https://lists.suse.com/pipermail/sle-security-updates/2015-March/001275.html E-Mail link for SUSE-SU-2015:0457-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/916343 SUSE Bug 916343 https://bugzilla.suse.com/916785 SUSE Bug 916785 https://www.suse.com/security/cve/CVE-2015-0245/ SUSE CVE CVE-2015-0245 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Software Development Kit 12 dbus-1-1.8.16-14.1 dbus-1-x11-1.8.16-14.1 libdbus-1-3-1.8.16-14.1 libdbus-1-3-32bit-1.8.16-14.1 dbus-1-devel-1.8.16-14.1 dbus-1-devel-doc-1.8.16-14.1 dbus-1-1.8.16-14.1 as a component of SUSE Linux Enterprise Desktop 12 dbus-1-x11-1.8.16-14.1 as a component of SUSE Linux Enterprise Desktop 12 libdbus-1-3-1.8.16-14.1 as a component of SUSE Linux Enterprise Desktop 12 libdbus-1-3-32bit-1.8.16-14.1 as a component of SUSE Linux Enterprise Desktop 12 dbus-1-1.8.16-14.1 as a component of SUSE Linux Enterprise Server 12 dbus-1-x11-1.8.16-14.1 as a component of SUSE Linux Enterprise Server 12 libdbus-1-3-1.8.16-14.1 as a component of SUSE Linux Enterprise Server 12 libdbus-1-3-32bit-1.8.16-14.1 as a component of SUSE Linux Enterprise Server 12 dbus-1-1.8.16-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 dbus-1-x11-1.8.16-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libdbus-1-3-1.8.16-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 libdbus-1-3-32bit-1.8.16-14.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 dbus-1-devel-1.8.16-14.1 as a component of SUSE Linux Enterprise Software Development Kit 12 dbus-1-devel-doc-1.8.16-14.1 as a component of SUSE Linux Enterprise Software Development Kit 12 D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds. CVE-2015-0245 SUSE Linux Enterprise Desktop 12:dbus-1-1.8.16-14.1 SUSE Linux Enterprise Desktop 12:dbus-1-x11-1.8.16-14.1 SUSE Linux Enterprise Desktop 12:libdbus-1-3-1.8.16-14.1 SUSE Linux Enterprise Desktop 12:libdbus-1-3-32bit-1.8.16-14.1 SUSE Linux Enterprise Server 12:dbus-1-1.8.16-14.1 SUSE Linux Enterprise Server 12:dbus-1-x11-1.8.16-14.1 SUSE Linux Enterprise Server 12:libdbus-1-3-1.8.16-14.1 SUSE Linux Enterprise Server 12:libdbus-1-3-32bit-1.8.16-14.1 SUSE Linux Enterprise Server for SAP Applications 12:dbus-1-1.8.16-14.1 SUSE Linux Enterprise Server for SAP Applications 12:dbus-1-x11-1.8.16-14.1 SUSE Linux Enterprise Server for SAP Applications 12:libdbus-1-3-1.8.16-14.1 SUSE Linux Enterprise Server for SAP Applications 12:libdbus-1-3-32bit-1.8.16-14.1 SUSE Linux Enterprise Software Development Kit 12:dbus-1-devel-1.8.16-14.1 SUSE Linux Enterprise Software Development Kit 12:dbus-1-devel-doc-1.8.16-14.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150457-1/ https://www.suse.com/security/cve/CVE-2015-0245.html CVE-2015-0245 https://bugzilla.suse.com/1003898 SUSE Bug 1003898 https://bugzilla.suse.com/916343 SUSE Bug 916343