Bug 1434100 – CVE-2017-2663 subscription-manager: unsafe dbus interface

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1434100 - (CVE-2017-2663) CVE-2017-2663 subscription-manager: unsafe dbus interface

Summary:	CVE-2017-2663 subscription-manager: unsafe dbus interface

Status:	CLOSED NOTABUG

Aliases:	CVE-2017-2663

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,reported=20170320,sou...
Keywords:	Security

Depends On:	1434493
Blocks:	1433383
	Show dependency tree / graph

Reported:	2017-03-20 13:35 EDT by Cedric Buissart
Modified:	2017-03-22 11:30 EDT (History)
CC List:	6 users (show)

See Also:
Fixed In Version:	subscription-manager 1.19.4
Doc Type:	If docs needed, set a value
Doc Text:	It was found that subscription-manager's DBus interface let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and com.redhat.RHSM1.Config.Set methods. An unprivileged local attacker could use these methods to gain access to private information, or launch a privilege escalation attack.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-03-22 04:51:30 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Cedric Buissart 2017-03-20 13:35:18 EDT

Subscription-manager's new DBus interface allows unprivileged local user to have access to information known to root only, and/or to modify subscription-manager configuration file.
An attacker could use this flaw to escalate its privileges, or to gain access to private information.

Commit enabling the dbus interface (subscription-manager-1.19.0) :
https://github.com/candlepin/subscription-manager/commit/2aa48ef65

Comment 1 Cedric Buissart 2017-03-21 06:18:03 EDT

Required patches :
 * Lock down Facts object to be accessible to root only.
https://github.com/candlepin/subscription-manager/commit/882bb587a
 * 1434094: Deny D-BUS Config.Set from non-root
https://github.com/candlepin/subscription-manager/commit/afa0f7afee

Comment 2 Cedric Buissart 2017-03-21 11:43:25 EDT

Created subscription-manager tracking bugs for this issue:

Affects: fedora-all [bug 1434493]

Comment 3 Cedric Buissart 2017-03-21 11:45:59 EDT

Statement:

This issue did not affect the versions of subscription-manager as shipped with Red Hat Enterprise Linux 5, 6 and 7 as they did not include support for the DBus interface.

Comment 4 Cedric Buissart 2017-03-21 12:27:00 EDT

Acknowledgments:

Name: Cedric Buissart (Red Hat)

Note You need to log in before you can comment on or make changes to this bug.