group.of.nepali.translators team mailing list archive

[Launchpad Bug Tracker <1666358@xxxxxxxxxxxxxxxxxx>]

This bug was fixed in the package iio-sensor-proxy - 1.3-1ubuntu2

---------------
iio-sensor-proxy (1.3-1ubuntu2) yakkety-security; urgency=medium

   * SECURITY UPDATE: insecure dbus configuration (LP: #1666358)
    - debian/patches/iio-dbus-policy-security.patch:
      Patch from Debian, applied upstream. Restrict send_destination
      to "net.hadess.SensorProxy" in net.hadess.SensorProxy.conf

 -- Jeremy Bicha <jbicha@xxxxxxxxxx>  Mon, 20 Feb 2017 21:17:39 -0500

** Changed in: iio-sensor-proxy (Ubuntu Yakkety)
       Status: Confirmed => Fix Released

** Changed in: iio-sensor-proxy (Ubuntu Xenial)
       Status: Confirmed => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1666358

Title:
  iio-sensor-proxy: Insecure configuration of dbus service

Status in IIO Sensor Proxy:
  Fix Released
Status in iio-sensor-proxy package in Ubuntu:
  Fix Released
Status in iio-sensor-proxy source package in Xenial:
  Fix Released
Status in iio-sensor-proxy source package in Yakkety:
  Fix Released
Status in iio-sensor-proxy package in Debian:
  Fix Released

Bug description:
  The dbus configuration for iio-sensor-proxy allowed any process on the
  system bus to send an org.freedesktop.DBus.Properties.Set() call to
  any other process on the system bus, even if the destination process
  expected to be only accessible by root.

  https://github.com/hadess/iio-sensor-proxy/commit/e2d81f2

  This was fixed in the upstream version 2.1
  and in Debian's 2.0-4 (which was autosynced to zesty).

  Test Case
  =========
  dbus-send --system --dest=org.freedesktop.nm_dispatcher --type=method_call \
      --print-reply / org.freedesktop.DBus.Properties.Set string:Foo variant:string:bar

  Bad response:
  Error org.freedesktop.DBus.Error.UnknownMethod: No such interface
   'org.freedesktop.DBus.Properties' on object at path /

  Good response:
  Error org.freedesktop.DBus.Error.AccessDenied: Rejected send message, 2 matched  rules; type="method_call", sender=":1.5523" (uid=1000 pid=13527
   comm="dbus-send --system --dest=org.freedesktop.nm_dispa")
   interface="org.freedesktop.DBus.Properties" member="Set" error
   name="(unset)" requested_reply="0"
   destination="org.freedesktop.nm_dispatcher" (uid=0 pid=13528
   comm="/usr/lib/NetworkManager/nm-dispatcher ")

  Testing Done
  ============
  I built the packages in my PPA and installed to Ubuntu GNOME 16.04.2 and 16.10. The test cases completed successfully after install; no log out required.

To manage notifications about this bug go to:
https://bugs.launchpad.net/iio-sensor-proxy/+bug/1666358/+subscriptions