Bug 1212126 (CVE-2023-34969) - VUL-0: CVE-2023-34969: dbus-1: D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon
Summary: VUL-0: CVE-2023-34969: dbus-1: D-Bus before 1.15.6 sometimes allows unprivile...
Status: RESOLVED FIXED
Alias: CVE-2023-34969
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/368822/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-34969:4.7:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-06-08 06:56 UTC by Gianluca Gabrielli
Modified: 2023-08-25 08:19 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Gianluca Gabrielli 2023-06-08 06:56:06 UTC 
D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If
a privileged user with control over the dbus-daemon is using the
org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then
an unprivileged user with the ability to connect to the same dbus-daemon can
cause a dbus-daemon crash under some circumstances via an unreplyable message.
When done on the well-known system bus, this is a denial-of-service
vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-34969
https://www.cve.org/CVERecord?id=CVE-2023-34969
https://gitlab.freedesktop.org/dbus/dbus/-/issues/457
Comment 1 Gianluca Gabrielli 2023-06-08 06:56:58 UTC 
Affected packages:
 - SUSE:SLE-12-SP3:Update/dbus-1
 - SUSE:SLE-12-SP5:Update/dbus-1
 - SUSE:SLE-12:Update/dbus-1
 - SUSE:SLE-15-SP1:Update/dbus-1
 - SUSE:SLE-15-SP4:Update/dbus-1
 - SUSE:SLE-15:Update/dbus-1
 - openSUSE:Factory/dbus-1

Patch: https://gitlab.freedesktop.org/dbus/dbus/-/commit/b159849e031000d1dbc1ab876b5fc78a3ce9b534.patch
Comment 2 Dirk Mueller 2023-06-12 21:19:03 UTC 
openSUSE Factory has been fixed already.
Comment 3 OBSbugzilla Bot 2023-06-12 22:35:02 UTC 
This is an autogenerated message for OBS integration:
This bug (1212126) was mentioned in
https://build.opensuse.org/request/show/1092691 Factory / dbus-1
Comment 5 Simon Lees 2023-06-19 10:21:17 UTC 
Fixed for all current SLE streams and Submitted the tumbleweed fix for ALP so reassigning.
Comment 9 Maintenance Automation 2023-07-19 09:19:49 UTC 
SUSE-SU-2023:2879-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1212126
CVE References: CVE-2023-34969
Sources used:
SUSE Manager Retail Branch Server 4.2 (src): dbus-1-x11-1.12.2-150100.8.17.1, dbus-1-1.12.2-150100.8.17.1
SUSE Manager Server 4.2 (src): dbus-1-x11-1.12.2-150100.8.17.1, dbus-1-1.12.2-150100.8.17.1
SUSE Linux Enterprise Micro 5.1 (src): dbus-1-1.12.2-150100.8.17.1
SUSE Linux Enterprise Micro 5.2 (src): dbus-1-x11-1.12.2-150100.8.17.1, dbus-1-1.12.2-150100.8.17.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): dbus-1-x11-1.12.2-150100.8.17.1, dbus-1-1.12.2-150100.8.17.1
SUSE Linux Enterprise Real Time 15 SP3 (src): dbus-1-x11-1.12.2-150100.8.17.1, dbus-1-1.12.2-150100.8.17.1
SUSE Manager Proxy 4.2 (src): dbus-1-x11-1.12.2-150100.8.17.1, dbus-1-1.12.2-150100.8.17.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Maintenance Automation 2023-07-19 09:19:54 UTC 
SUSE-SU-2023:2877-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1212126
CVE References: CVE-2023-34969
Sources used:
openSUSE Leap Micro 5.3 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
openSUSE Leap 15.4 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
openSUSE Leap 15.5 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
SUSE Linux Enterprise Micro 5.3 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
SUSE Linux Enterprise Micro 5.4 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
Basesystem Module 15-SP4 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1
Basesystem Module 15-SP5 (src): dbus-1-1.12.2-150400.18.8.1, dbus-1-x11-1.12.2-150400.18.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Maintenance Automation 2023-07-19 09:19:57 UTC 
SUSE-SU-2023:2876-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1212126
CVE References: CVE-2023-34969
Sources used:
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): dbus-1-x11-1.8.22-44.1, dbus-1-1.8.22-44.1
SUSE Linux Enterprise Server 12 SP5 (src): dbus-1-x11-1.8.22-44.1, dbus-1-1.8.22-44.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): dbus-1-x11-1.8.22-44.1, dbus-1-1.8.22-44.1
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): dbus-1-x11-1.8.22-44.1, dbus-1-1.8.22-44.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.