FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2013-0292

This CVE name corresponds to:

Entered	Topic
2014-04-11	dbus-glib -- privledge escalation

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2013-0292 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2013-0292
Phase	Assigned(20121206)

Description

The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal.

References

Source	Reference
EXPLOIT-DB	33614
MLIST	[oss-security] 20130215 CVE-2013-0292: authentication bypass due to insufficient checks in dbus-glib < 0.100.1
MISC	http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=911658
CONFIRM	http://cgit.freedesktop.org/dbus/dbus-glib/commit/?id=166978a09cf5edff4028e670b6074215a4c75eca
CONFIRM	https://bugs.freedesktop.org/show_bug.cgi?id=60916
MANDRIVA	MDVSA-2013:071
REDHAT	RHSA-2013:0568
UBUNTU	USN-1753-1
BID	57985
OSVDB	90302
SECUNIA	52225
SECUNIA	52375
SECUNIA	52404
XF	dbus-message-sender-priv-esc(82135)