[security-announce] SUSE-SU-2014:1146-1: important: Security update for dbus-1

[news 28]

SUSE Security Update: Security update for dbus-1

______________________________________________________________________________

 

Announcement ID: SUSE-SU-2014:1146-1

Rating: important

References: #896453

Cross-References: CVE-2014-3638

Affected Products:

SUSE Linux Enterprise Software Development Kit 11 SP3

SUSE Linux Enterprise Server 11 SP3 for VMware

SUSE Linux Enterprise Server 11 SP3

SUSE Linux Enterprise Desktop 11 SP3

______________________________________________________________________________

 

An update that fixes one vulnerability is now available.

 

Description:

 

 

Various denial of service issues were fixed in the DBUS service.

 

* CVE-2014-3638: dbus-daemon tracks whether method call messages

expect a reply, so that unsolicited replies can be dropped. As

currently implemented, if there are n parallel method calls in

progress, each method reply takes O(n) CPU time. A malicious user

could exploit this by opening the maximum allowed number of parallel

connections and sending the maximum number of parallel method calls

on each one, causing subsequent method calls to be unreasonably

slow, a denial of service.

* CVE-2014-3639: dbus-daemon allows a small number of "incomplete"

connections (64 by default) whose identity has not yet been

confirmed. When this limit has been reached, subsequent connections

are dropped. Alban's testing indicates that one malicious process

that makes repeated connection attempts, but never completes the

authentication handshake and instead waits for dbus-daemon to time

out and disconnect it, can cause the majority of legitimate

connection attempts to fail.

 

Security Issues:

 

* CVE-2014-3638

 

* CVE-2014-3638

 

 

 

Patch Instructions:

 

To install this SUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

 

- SUSE Linux Enterprise Software Development Kit 11 SP3:

 

zypper in -t patch sdksp3-dbus-1-9733

 

- SUSE Linux Enterprise Server 11 SP3 for VMware:

 

zypper in -t patch slessp3-dbus-1-9733

 

- SUSE Linux Enterprise Server 11 SP3:

 

zypper in -t patch slessp3-dbus-1-9733

 

- SUSE Linux Enterprise Desktop 11 SP3:

 

zypper in -t patch sledsp3-dbus-1-9733

 

To bring your system up-to-date, use "zypper patch".

 

 

Package List:

 

- SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64):

 

dbus-1-devel-1.2.10-3.31.1

dbus-1-devel-doc-1.2.10-3.31.1

 

- SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64):

 

dbus-1-1.2.10-3.31.1

dbus-1-x11-1.2.10-3.31.1

 

- SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64):

 

dbus-1-32bit-1.2.10-3.31.1

 

- SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64):

 

dbus-1-1.2.10-3.31.1

dbus-1-x11-1.2.10-3.31.1

 

- SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64):

 

dbus-1-32bit-1.2.10-3.31.1

 

- SUSE Linux Enterprise Server 11 SP3 (ia64):

 

dbus-1-x86-1.2.10-3.31.1

 

- SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64):

 

dbus-1-1.2.10-3.31.1

dbus-1-x11-1.2.10-3.31.1

 

- SUSE Linux Enterprise Desktop 11 SP3 (x86_64):

 

dbus-1-32bit-1.2.10-3.31.1

 

 

References:

 

http://support.novell.com/security/cve/CVE-2014-3638.html

https://bugzilla.novell.com/896453

http://download.suse.com/patch/finder/?keywords=d849773a0381e2782725dff671102c86

 

--

To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org

For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org