[ MDVSA-2008:054 ] - Updated dbus packages fix vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2008:054
http://www.mandriva.com/security/
_______________________________________________________________________
Package : dbus
Date : February 28, 2008
Affected: 2007.0, 2007.1, 2008.0
_______________________________________________________________________
Problem Description:
A vulnerability was discovered by Havoc Pennington in how the
dbus-daemon applied its security policy. A user with the ability
to connect to the dbus-daemon could possibly execute certain method
calls that they should not normally have access to.
The updated packages have been patched to correct these issues.
Users will have to reboot the system once these packages have been
installed in order to prevent problems due to service dependencies
on the messagebus service.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0595
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
5a7276c83f7f3ac5e2d8f26f3cf0fed9 2007.0/i586/dbus-0.92-8.3mdv2007.0.i586.rpm
e97939d34bc7d3782bf8c5f54b6bca90
2007.0/i586/dbus-x11-0.92-8.3mdv2007.0.i586.rpm
9163f5e8243bf78d88be99329ee5536e
2007.0/i586/libdbus-1_3-0.92-8.3mdv2007.0.i586.rpm
dd9015731ae2557d7e0962204eedacc3
2007.0/i586/libdbus-1_3-devel-0.92-8.3mdv2007.0.i586.rpm
7e124dac56bfef6f1966cbc2f535fa7b 2007.0/SRPMS/dbus-0.92-8.3mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
79ace61e47f1dee7e62cfa2e7b1fd700
2007.0/x86_64/dbus-0.92-8.3mdv2007.0.x86_64.rpm
422ee658a55a0b36f53be71965e6d890
2007.0/x86_64/dbus-x11-0.92-8.3mdv2007.0.x86_64.rpm
e7126e8743aaa2994815eac7816ab1af
2007.0/x86_64/lib64dbus-1_3-0.92-8.3mdv2007.0.x86_64.rpm
ff7a748f340acc367150b76bc96d9144
2007.0/x86_64/lib64dbus-1_3-devel-0.92-8.3mdv2007.0.x86_64.rpm
7e124dac56bfef6f1966cbc2f535fa7b 2007.0/SRPMS/dbus-0.92-8.3mdv2007.0.src.rpm
Mandriva Linux 2007.1:
c46891482cb070370be2c6157d6bef2f 2007.1/i586/dbus-1.0.2-5.1mdv2007.1.i586.rpm
ce9017c03cf6da6c230813a17575e3ec
2007.1/i586/dbus-x11-1.0.2-5.1mdv2007.1.i586.rpm
6c4101834728f802046b542f151b1610
2007.1/i586/libdbus-1_3-1.0.2-5.1mdv2007.1.i586.rpm
77e621ee92730a2dc2cf1afa3767fb0f
2007.1/i586/libdbus-1_3-devel-1.0.2-5.1mdv2007.1.i586.rpm
871e7bf8eb42f738ea608498bb22c83d 2007.1/SRPMS/dbus-1.0.2-5.1mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
810876faa8ab66ad81208e478d1b6c66
2007.1/x86_64/dbus-1.0.2-5.1mdv2007.1.x86_64.rpm
8264902b916bf8173254d409190e4521
2007.1/x86_64/dbus-x11-1.0.2-5.1mdv2007.1.x86_64.rpm
9af9c3dafc670a714fccd436eb2f5f55
2007.1/x86_64/lib64dbus-1_3-1.0.2-5.1mdv2007.1.x86_64.rpm
74eab3e48b81c4d28059e18d2f85c6cd
2007.1/x86_64/lib64dbus-1_3-devel-1.0.2-5.1mdv2007.1.x86_64.rpm
871e7bf8eb42f738ea608498bb22c83d 2007.1/SRPMS/dbus-1.0.2-5.1mdv2007.1.src.rpm
Mandriva Linux 2008.0:
8229d2b51c125547a97777820e2b1a07 2008.0/i586/dbus-1.0.2-10.1mdv2008.0.i586.rpm
54cda1c75e70def572ad0863ff5906be
2008.0/i586/dbus-x11-1.0.2-10.1mdv2008.0.i586.rpm
c0fe93aefc3fb7ba23c1fa094e514fb6
2008.0/i586/libdbus-1_3-1.0.2-10.1mdv2008.0.i586.rpm
73faf4f17084c8d7649ae9a7ba2388a8
2008.0/i586/libdbus-1_3-devel-1.0.2-10.1mdv2008.0.i586.rpm
434db235c2a5c47a71da59419c47af6f 2008.0/SRPMS/dbus-1.0.2-10.1mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
bbd678498ca22dbc20f9c3a1e5070242
2008.0/x86_64/dbus-1.0.2-10.1mdv2008.0.x86_64.rpm
91b3a599276bea83e65090250944c83c
2008.0/x86_64/dbus-x11-1.0.2-10.1mdv2008.0.x86_64.rpm
d2e9804fbe492b9d00784c05e739f46d
2008.0/x86_64/lib64dbus-1_3-1.0.2-10.1mdv2008.0.x86_64.rpm
0088a4965b25db33615eb7192dff7ddc
2008.0/x86_64/lib64dbus-1_3-devel-1.0.2-10.1mdv2008.0.x86_64.rpm
434db235c2a5c47a71da59419c47af6f 2008.0/SRPMS/dbus-1.0.2-10.1mdv2008.0.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
iD8DBQFHxwVDmqjQ0CJFipgRAlScAJ966LnErJsKArKsfS1yz1cEldmHDwCeJAZR
3fSZdCJDeg1PV6q5CFGDGK8=
=kpoA
-----END PGP SIGNATURE-----