CVE-2012-3524
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Description
libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00000.html
- http://lists.opensuse.org/opensuse-updates/2012-10/msg00094.html
- http://rhn.redhat.com/errata/RHSA-2012-1261.html
References (23)
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.