Bug 1212126 (CVE-2023-34969)

Summary:	VUL-0: CVE-2023-34969: dbus-1: D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Gianluca Gabrielli <gianluca.gabrielli>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	rfrohl, security-team, stoyan.manolov
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/368822/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-34969:4.7:(AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Gianluca Gabrielli 2023-06-08 06:56:06 UTC

D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If
a privileged user with control over the dbus-daemon is using the
org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then
an unprivileged user with the ability to connect to the same dbus-daemon can
cause a dbus-daemon crash under some circumstances via an unreplyable message.
When done on the well-known system bus, this is a denial-of-service
vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-34969
https://www.cve.org/CVERecord?id=CVE-2023-34969
https://gitlab.freedesktop.org/dbus/dbus/-/issues/457

Comment 1 Gianluca Gabrielli 2023-06-08 06:56:58 UTC

Affected packages:
 - SUSE:SLE-12-SP3:Update/dbus-1
 - SUSE:SLE-12-SP5:Update/dbus-1
 - SUSE:SLE-12:Update/dbus-1
 - SUSE:SLE-15-SP1:Update/dbus-1
 - SUSE:SLE-15-SP4:Update/dbus-1
 - SUSE:SLE-15:Update/dbus-1
 - openSUSE:Factory/dbus-1

Patch: https://gitlab.freedesktop.org/dbus/dbus/-/commit/b159849e031000d1dbc1ab876b5fc78a3ce9b534.patch

Comment 2 Dirk Mueller 2023-06-12 21:19:03 UTC

openSUSE Factory has been fixed already.

Comment 3 OBSbugzilla Bot 2023-06-12 22:35:02 UTC

This is an autogenerated message for OBS integration:
This bug (1212126) was mentioned in
https://build.opensuse.org/request/show/1092691 Factory / dbus-1

Comment 5 Simon Lees 2023-06-19 10:21:17 UTC

Fixed for all current SLE streams and Submitted the tumbleweed fix for ALP so reassigning.

Comment 9 Maintenance Automation 2023-07-19 09:19:49 UTC

SUSE-SU-2023:2879-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1212126
CVE References: CVE-2023-34969
Sources used:
SUSE Manager Retail Branch Server 4.2 (src): dbus-1-x11-1.12.2-150100.8.17.1, dbus-1-1.12.2-150100.8.17.1
SUSE Manager Server 4.2 (src): dbus-1-x11-1.12.2-150100.8.17.1, dbus-1-1.12.2-150100.8.17.1
SUSE Linux Enterprise Micro 5.1 (src): dbus-1-1.12.2-150100.8.17.1
SUSE Linux Enterprise Micro 5.2 (src): dbus-1-x11-1.12.2-150100.8.17.1, dbus-1-1.12.2-150100.8.17.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): dbus-1-x11-1.12.2-150100.8.17.1, dbus-1-1.12.2-150100.8.17.1
SUSE Linux Enterprise Real Time 15 SP3 (src): dbus-1-x11-1.12.2-150100.8.17.1, dbus-1-1.12.2-150100.8.17.1
SUSE Manager Proxy 4.2 (src): dbus-1-x11-1.12.2-150100.8.17.1, dbus-1-1.12.2-150100.8.17.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 10 Maintenance Automation 2023-07-19 09:19:54 UTC

SUSE-SU-2023:2877-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1212126
CVE References: CVE-2023-34969
Sources used:
openSUSE Leap Micro 5.3 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
openSUSE Leap 15.4 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
openSUSE Leap 15.5 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
SUSE Linux Enterprise Micro 5.3 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
SUSE Linux Enterprise Micro 5.4 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
Basesystem Module 15-SP4 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
Basesystem Module 15-SP5 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Maintenance Automation 2023-07-19 09:19:57 UTC

SUSE-SU-2023:2876-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1212126
CVE References: CVE-2023-34969
Sources used:
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): dbus-1-x11-1.8.22-44.1, dbus-1-1.8.22-44.1
SUSE Linux Enterprise Server 12 SP5 (src): dbus-1-x11-1.8.22-44.1, dbus-1-1.8.22-44.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): dbus-1-x11-1.8.22-44.1, dbus-1-1.8.22-44.1
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): dbus-1-x11-1.8.22-44.1, dbus-1-1.8.22-44.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.