From f8eeb881ffd4c84af53d6360ee689f21b0b10597 Mon Sep 17 00:00:00 2001 From: "John (J5) Palmieri" Date: Tue, 26 Feb 2008 13:51:16 -0500 Subject: CVE-2008-0595 dbus security policy circumvention * CVE-2008-0595 - security policy of the type work as an implicit allow for messages sent without an interface bypassing the default deny rules and potentially allowing restricted methods exported on the bus to be executed by unauthorized users. This patch fixes the issue. * bus/policy.c (bus_client_policy_check_can_send, bus_client_policy_check_can_receive): skip messages without an interface when evaluating an allow rule --- ChangeLog | 12 ++++++++++++ bus/policy.c | 32 ++++++++++++++++++++++++++------ 2 files changed, 38 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index d78dd1d6..4f6ee7c6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,15 @@ +2008-02-26 John (J5) Palmieri + + * CVE-2008-0595 - security policy of the type work as an implicit allow for + messages sent without an interface bypassing the default deny rules + and potentially allowing restricted methods exported on the bus to be + executed by unauthorized users. This patch fixes the issue. + * bus/policy.c (bus_client_policy_check_can_send, + bus_client_policy_check_can_receive): skip messages without an + interface when evaluating an allow rule, and thus pass it to the + default deny rules + 2008-02-26 John (J5) Palmieri * correctly unref connections without guids during shutdown diff --git a/bus/policy.c b/bus/policy.c index c0244bdc..ff8a70e7 100644 --- a/bus/policy.c +++ b/bus/policy.c @@ -931,9 +931,19 @@ bus_client_policy_check_can_send (BusClientPolicy *policy, if (rule->d.send.interface != NULL) { - if (dbus_message_get_interface (message) != NULL && - strcmp (dbus_message_get_interface (message), - rule->d.send.interface) != 0) + /* The interface is optional in messages. For allow rules, if the message + * has no interface we want to skip the rule (and thus not allow); + * for deny rules, if the message has no interface we want to use the + * rule (and thus deny). + */ + dbus_bool_t no_interface; + + no_interface = dbus_message_get_interface (message) == NULL; + + if ((no_interface && rule->allow) || + (!no_interface && + strcmp (dbus_message_get_interface (message), + rule->d.send.interface) != 0)) { _dbus_verbose (" (policy) skipping rule for different interface\n"); continue; @@ -1117,9 +1127,19 @@ bus_client_policy_check_can_receive (BusClientPolicy *policy, if (rule->d.receive.interface != NULL) { - if (dbus_message_get_interface (message) != NULL && - strcmp (dbus_message_get_interface (message), - rule->d.receive.interface) != 0) + /* The interface is optional in messages. For allow rules, if the message + * has no interface we want to skip the rule (and thus not allow); + * for deny rules, if the message has no interface we want to use the + * rule (and thus deny). + */ + dbus_bool_t no_interface; + + no_interface = dbus_message_get_interface (message) == NULL; + + if ((no_interface && rule->allow) || + (!no_interface && + strcmp (dbus_message_get_interface (message), + rule->d.receive.interface) != 0)) { _dbus_verbose (" (policy) skipping rule for different interface\n"); continue; -- cgit