Bugzilla – Bug 836937
VUL-0: CVE-2013-4325 hplip: use of insecure polkit DBUS API (polkit-process subject race condition)
Last modified: 2019-05-01 16:08:05 UTC
+++ This bug was initially created as a clone of Bug #835827 +++ This is a place holder for the upcoming polkit pkcheck race fix which is discussed with upstream.
Anyone could bypass the polkit check and install plugins/drivers. Attaching proposed fix from upstream. No CRD yet. The issue is EMBARGOED.
Created attachment 554414 [details] proposed patch, using systembus rather than pid .
CVE-2013-4288
CRD Sept 11th
New CRD coming and new CVE: CVE-2013-4325 hplip: use of insecure polkit DBUS API please hold submission until new CRD is confirmed.
New CRD: Sept 18th.
I didn't find documentation how to do it for a product that is currently in RC phase (i.e. openSUSE 13.1). I did the following: ----------------------------------------------------------------------------- $ osc branch openSUSE:13.1 hplip [added fix-CVE-2013-4325.diff] $ osc submitrequest -m \ 'HPLIP security fix for bnc#836937 CVE-2013-4325 for openSUSE 13.1' \ home:jsmeix:branches:openSUSE:13.1 hplip openSUSE:13.1 hplip Server returned an error: HTTP Error 403: Forbidden The target project openSUSE:13.1 is not accepting requests because: Please submit to openSUSE:Factory or openSUSE:13.1:Update $ osc submitrequest -m \ 'HPLIP security fix for bnc#836937 CVE-2013-4325 for openSUSE 13.1' \ home:jsmeix:branches:openSUSE:13.1 hplip openSUSE:13.1:Update hplip WARNING: WARNING: Project does not accept submit request, request to open a NEW maintenance incident instead WARNING: created request id Request: #204271 maintenance_incident: home:jsmeix:branches:openSUSE:13.1/hplip -> openSUSE:Maintenance (release in openSUSE:13.1:Update) Message: HPLIP security fix for bnc#836937 CVE-2013-4325 for openSUSE 13.1 State: new 2013-10-22T10:14:40 jsmeix Comment: <no comment> -----------------------------------------------------------------------------
This is an autogenerated message for OBS integration: This bug (836937) was mentioned in https://build.opensuse.org/request/show/204271 13.1 / hplip
Submitted also a fix for openSUSE 12.3: ------------------------------------------------------------------------------ $ osc submitrequest -m \ 'HPLIP security fix for bnc#836937 CVE-2013-4325 for openSUSE 12.3' \ home:jsmeix:branches:openSUSE:12.3:Update hplip openSUSE:12.3:Update hplip WARNING: WARNING: Project does not accept submit request, request to open a NEW maintenance incident instead WARNING: created request id Request: #204312 maintenance_incident: home:jsmeix:branches:openSUSE:12.3:Update/hplip -> openSUSE:Maintenance (release in openSUSE:12.3:Update) Message: HPLIP security fix for bnc#836937 CVE-2013-4325 for openSUSE 12.3 State: new 2013-10-22T14:03:46 jsmeix Comment: <no comment> ------------------------------------------------------------------------------
This is an autogenerated message for OBS integration: This bug (836937) was mentioned in https://build.opensuse.org/request/show/204312 12.3 / hplip
Submitted also a fix for openSUSE 12.2: ------------------------------------------------------------------------------ $ osc submitrequest -m \ 'HPLIP security fix for bnc#836937 CVE-2013-4325 for openSUSE 12.2' \ home:jsmeix:branches:openSUSE:12.2:Update hplip openSUSE:12.2:Update hplip WARNING: WARNING: Project does not accept submit request, request to open a NEW maintenance incident instead WARNING: created request id Request: #204429 maintenance_incident: home:jsmeix:branches:openSUSE:12.2:Update/hplip -> openSUSE:Maintenance (release in openSUSE:12.2:Update) Message: HPLIP security fix for bnc#836937 CVE-2013-4325 for openSUSE 12.2 State: new 2013-10-23T12:25:55 jsmeix Comment: <no comment> ------------------------------------------------------------------------------
According to -------------------------------------------- $ osc maintained hplip openSUSE:12.2:Update/hplip openSUSE:12.3:Update/hplip -------------------------------------------- the issue is now fixed for all maintained openSUSE versions plus the upcomming openSUSE 13.1.
This is an autogenerated message for OBS integration: This bug (836937) was mentioned in https://build.opensuse.org/request/show/204429 12.2 / hplip
My fix for openSUSE 12.2 is broken! For now do not release it. I am correcting it...
I cannot revoke request 204429 because it is already accepted. I submitted request 204439 with the fixed fix for openSUSE 12.2.
This is an autogenerated message for OBS integration: This bug (836937) was mentioned in https://build.opensuse.org/request/show/204439 12.2 / hplip
openSUSE-SU-2013:1617-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 835827,836937 CVE References: CVE-2013-4288,CVE-2013-4325 Sources used: openSUSE 12.3 (src): hplip-3.12.11-2.5.1 openSUSE 12.2 (src): hplip-3.12.4-3.6.1
openSUSE-SU-2013:1620-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 835827,836937 CVE References: CVE-2013-4288,CVE-2013-4325 Sources used: openSUSE 11.4 (src): hplip-3.11.5-1.15.1
assuming fixed, and sle requiring no fix currently.
Fixed
update not yet finished
(In reply to comment #37) Please make my bug list free! That is do not block bugs for the assignee systemd-maintainers. I'd like to be able to reduce number of open bugs to have a better view on the relevant bugs
I cleaned up the dependencies. Thats better? We need to keep this bug open for trackin, in particular there seems to be some issues in hplip which we want to fix along.
(In reply to comment #39) Indeed the systemd bug #836932 remains closed, thanks a lot
Update released for: hplip, hplip-debuginfo, hplip-debugsource, hplip-hpijs Products: SLE-DEBUGINFO 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLE-DESKTOP 11-SP2 (i386, x86_64) SLE-SERVER 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLES4VMWARE 11-SP2 (i386, x86_64)
SUSE-SU-2014:0188-1: An update that solves three vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 808355,835827,836937,852368 CVE References: CVE-2013-0200,CVE-2013-4325,CVE-2013-6402 Sources used: SUSE Linux Enterprise Server 11 SP2 for VMware (src): hplip-3.11.10-0.6.11.1 SUSE Linux Enterprise Server 11 SP2 (src): hplip-3.11.10-0.6.11.1 SUSE Linux Enterprise Desktop 11 SP2 (src): hplip-3.11.10-0.6.11.1
SUSE-SU-2014:0188-2: An update that solves three vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 808355,835827,836937,852368 CVE References: CVE-2013-0200,CVE-2013-4325,CVE-2013-6402 Sources used: SUSE Linux Enterprise Server 11 SP3 for VMware (src): hplip-3.11.10-0.6.11.1 SUSE Linux Enterprise Server 11 SP3 (src): hplip-3.11.10-0.6.11.1 SUSE Linux Enterprise Desktop 11 SP3 (src): hplip-3.11.10-0.6.11.1
sle10 not affected I suspect ... so done