製品・ソフトウェアに関する情報

JVN脆弱性詳細

libdbus における権限を取得される脆弱性

Title	libdbus における権限を取得される脆弱性
Summary	libdbus は、X.org などの製品において、setuid またはその他の特権的プログラムで使用される場合、権限を取得される、および任意のコードを実行される脆弱性が存在します。
Possible impacts	ローカルユーザにより、DBUS_SYSTEM_BUS_ADDRESS 環境変数を介して、権限を取得される、および任意のコードを実行される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Sept. 18, 2012, midnight
Registration Date	Sept. 20, 2012, 3:14 p.m.
Last Update	Nov. 9, 2012, 10:42 a.m.

CVSS2.0 : 警告
Score	6.9
Vector	AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected System

D-Bus

libdbus 1.5.x およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-3524	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3524
National Vulnerability Database (NVD)
2	CVE-2012-3524	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3524
SECURITY BLOG
3	CVE-2012-3524 Permissions, Privileges, and Access Controls vulnerability in libdbus	https://blogs.oracle.com/sunsecurity/entry/cve_2012_3524_permissions_privileges

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
Bugzilla
1	Bug 697105	https://bugzilla.novell.com/show_bug.cgi?id=697105
D-Bus
2	Bug 52202	https://bugs.freedesktop.org/show_bug.cgi?id=52202
opensuse-security-announce
3	openSUSE-SU-2012:1287	http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00000.html
4	SUSE-SU-2012:1155-1	http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00009.html
5	SUSE-SU-2012:1155-2	http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00015.html
Red Hat Bugzilla
6	Bug 847402	https://bugzilla.redhat.com/show_bug.cgi?id=847402
Red Hat Security Advisory
7	RHSA-2012:1261	http://rhn.redhat.com/errata/RHSA-2012-1261.html
Ubuntu Security Notice
8	USN-1576-1	http://www.ubuntu.com/usn/USN-1576-1
9	USN-1576-2	http://www.ubuntu.com/usn/USN-1576-2

Change Log

No	Changed Details	Date of change
0	[2012年09月20日] 掲載 [2012年10月23日] ベンダ情報：オラクル (CVE-2012-3524 Permissions, Privileges, and Access Controls vulnerability in libdbus) を追加 [2012年11月09日] ベンダ情報：Ubuntu (USN-1576-1) を追加ベンダ情報：Ubuntu (USN-1576-2) を追加ベンダ情報：openSUSE (openSUSE-SU-2012:1287) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2012-3524

Summary	libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."
Publication Date	Sept. 19, 2012, 2:55 a.m.
Registration Date	Jan. 28, 2021, 3 p.m.
Last Update	Nov. 21, 2024, 10:41 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:freedesktop:libdbus:1.5.2:::::::*
cpe:2.3:a:freedesktop:libdbus:1.5.6:::::::*
cpe:2.3:a:freedesktop:libdbus:1.5.8:::::::*
cpe:2.3:a:freedesktop:libdbus:1.5.0:::::::*
cpe:2.3:a:freedesktop:libdbus:1.5.10:::::::*
cpe:2.3:a:freedesktop:libdbus::::::::		1.5.12
cpe:2.3:a:freedesktop:libdbus:1.5.4:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00009.html
2	http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00009.html
3	http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00015.html
4	http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00015.html
5	http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00000.html
6	http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00000.html
7	http://lists.opensuse.org/opensuse-updates/2012-10/msg00094.html
8	http://lists.opensuse.org/opensuse-updates/2012-10/msg00094.html
9	http://rhn.redhat.com/errata/RHSA-2012-1261.html
10	http://rhn.redhat.com/errata/RHSA-2012-1261.html
11	http://secunia.com/advisories/50537	Vendor Advisory
12	http://secunia.com/advisories/50537	Vendor Advisory
13	http://secunia.com/advisories/50544
14	http://secunia.com/advisories/50544
15	http://secunia.com/advisories/50710
16	http://secunia.com/advisories/50710
17	http://stealth.openwall.net/null/dzug.c	Exploit
18	http://stealth.openwall.net/null/dzug.c	Exploit
19	http://www.exploit-db.com/exploits/21323	Exploit
20	http://www.exploit-db.com/exploits/21323	Exploit
21	http://www.mandriva.com/security/advisories?name=MDVSA-2013:070
22	http://www.mandriva.com/security/advisories?name=MDVSA-2013:070
23	http://www.mandriva.com/security/advisories?name=MDVSA-2013:083
24	http://www.mandriva.com/security/advisories?name=MDVSA-2013:083
25	http://www.openwall.com/lists/oss-security/2012/07/10/4
26	http://www.openwall.com/lists/oss-security/2012/07/10/4
27	http://www.openwall.com/lists/oss-security/2012/07/26/1
28	http://www.openwall.com/lists/oss-security/2012/07/26/1
29	http://www.openwall.com/lists/oss-security/2012/09/12/6
30	http://www.openwall.com/lists/oss-security/2012/09/12/6
31	http://www.openwall.com/lists/oss-security/2012/09/14/2
32	http://www.openwall.com/lists/oss-security/2012/09/14/2
33	http://www.openwall.com/lists/oss-security/2012/09/17/2
34	http://www.openwall.com/lists/oss-security/2012/09/17/2
35	http://www.securityfocus.com/bid/55517	Exploit
36	http://www.securityfocus.com/bid/55517	Exploit
37	http://www.ubuntu.com/usn/USN-1576-1
38	http://www.ubuntu.com/usn/USN-1576-1
39	http://www.ubuntu.com/usn/USN-1576-2
40	http://www.ubuntu.com/usn/USN-1576-2
41	https://bugs.freedesktop.org/show_bug.cgi?id=52202	Patch
42	https://bugs.freedesktop.org/show_bug.cgi?id=52202	Patch
43	https://bugzilla.novell.com/show_bug.cgi?id=697105
44	https://bugzilla.novell.com/show_bug.cgi?id=697105
45	https://bugzilla.redhat.com/show_bug.cgi?id=847402
46	https://bugzilla.redhat.com/show_bug.cgi?id=847402

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:freedesktop:libdbus:1.5.2:::::::*
cpe:2.3:a:freedesktop:libdbus:1.5.6:::::::*
cpe:2.3:a:freedesktop:libdbus:1.5.8:::::::*
cpe:2.3:a:freedesktop:libdbus:1.5.0:::::::*
cpe:2.3:a:freedesktop:libdbus:1.5.10:::::::*
cpe:2.3:a:freedesktop:libdbus::::::::		1.5.12
cpe:2.3:a:freedesktop:libdbus:1.5.4:::::::*