|
 |
942076 |
From 166978a09cf5edff4028e670b6074215a4c75eca Mon Sep 17 00:00:00 2001
|
|
|
942076 |
From: Colin Walters <walters@verbum.org>
|
|
|
942076 |
Date: Thu, 14 Feb 2013 10:19:34 -0500
|
|
|
942076 |
Subject: [PATCH] CVE-2013-0292: dbus-gproxy: Verify sender of NameOwnerChanged signals to be o.f.DBus
|
|
|
942076 |
|
|
|
942076 |
Anyone can hop on the bus and emit a signal whose interface is
|
|
|
942076 |
o.f.DBus; it's expected at the moments that clients (and notably DBus
|
|
|
942076 |
libraries) check the sender.
|
|
|
942076 |
|
|
|
942076 |
This could previously be used to trick a system service using dbus-glib
|
|
|
942076 |
into thinking a malicious signal came from a privileged source, by
|
|
|
942076 |
claiming that ownership of the privileged source's well-known name had
|
|
|
942076 |
changed from the privileged source's real unique name to the attacker's
|
|
|
942076 |
unique name.
|
|
|
942076 |
|
|
|
942076 |
[altered to be NULL-safe so it won't crash on peer connections -smcv]
|
|
|
942076 |
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
|
|
|
942076 |
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
|
|
|
942076 |
---
|
|
|
942076 |
dbus/dbus-gproxy.c | 7 ++++---
|
|
|
942076 |
1 files changed, 4 insertions(+), 3 deletions(-)
|
|
|
942076 |
|
|
|
942076 |
diff --git a/dbus/dbus-gproxy.c b/dbus/dbus-gproxy.c
|
|
|
942076 |
index 2fc52f9..c3ae9ec 100644
|
|
|
942076 |
--- a/dbus/dbus-gproxy.c
|
|
|
942076 |
+++ b/dbus/dbus-gproxy.c
|
|
|
942076 |
@@ -1250,8 +1250,11 @@ dbus_g_proxy_manager_filter (DBusConnection *connection,
|
|
|
942076 |
GSList *tmp;
|
|
|
942076 |
const char *sender;
|
|
|
942076 |
|
|
|
942076 |
+ sender = dbus_message_get_sender (message);
|
|
|
942076 |
+
|
|
|
942076 |
/* First we handle NameOwnerChanged internally */
|
|
|
942076 |
- if (dbus_message_is_signal (message,
|
|
|
942076 |
+ if (g_strcmp0 (sender, DBUS_SERVICE_DBUS) == 0 &&
|
|
|
942076 |
+ dbus_message_is_signal (message,
|
|
|
942076 |
DBUS_INTERFACE_DBUS,
|
|
|
942076 |
"NameOwnerChanged"))
|
|
|
942076 |
{
|
|
|
942076 |
@@ -1280,8 +1283,6 @@ dbus_g_proxy_manager_filter (DBusConnection *connection,
|
|
|
942076 |
}
|
|
|
942076 |
}
|
|
|
942076 |
|
|
|
942076 |
- sender = dbus_message_get_sender (message);
|
|
|
942076 |
-
|
|
|
942076 |
/* dbus spec requires these, libdbus validates */
|
|
|
942076 |
g_assert (dbus_message_get_path (message) != NULL);
|
|
|
942076 |
g_assert (dbus_message_get_interface (message) != NULL);
|
|
|
942076 |
--
|
|
|
942076 |
1.7.1
|
|
|
942076 |
|