https://bugzilla.novell.com/show_bug.cgi?id=708205 https://bugzilla.novell.com/show_bug.cgi?id=708205#c Guido Berhörster changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-screening@forge.pr |security-team@suse.de |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=708205 https://bugzilla.novell.com/show_bug.cgi?id=708205#c Sebastian Krahmer changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |krahmer@novell.com Summary|Review request for LightDM |AUDIT-0: Review request for |DBus system service |LightDM DBus system service -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=708205 https://bugzilla.novell.com/show_bug.cgi?id=708205#c2 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|AUDIT-0: Review request for |AUDIT-0: lightdb |LightDM DBus system service | --- Comment #2 from Ludwig Nussel 2011-07-29 11:26:43 CEST --- The file has a rather generic name and lxdm seems to implement a standard interface that is mean to be shared among displaymanagers, right? So I guess this config file should be put in some kind of base package required by all display managers. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=708205 https://bugzilla.novell.com/show_bug.cgi?id=708205#c3 --- Comment #3 from Guido Berhörster 2011-07-29 10:45:26 UTC --- (In reply to comment #2)

The file has a rather generic name and lxdm seems to implement a standard

Please note that LXDM (part of the LXDE project) and LightDM (http://www.freedesktop.org/wiki/Software/LightDM) are two unrelated projects.

interface that is mean to be shared among displaymanagers, right? So I guess this config file should be put in some kind of base package required by all display managers.

Possibly, however LightDM also has a broader aim than other display managers since its backend is toolkit-independent it can possibly to replace desktop-specific display managers like gdm, kdm etc. In any case, LightDM would be the only one implementing that interface. So do you want me to split this off, and if so, what should that package be named? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=708205 https://bugzilla.novell.com/show_bug.cgi?id=708205#c5 --- Comment #5 from Sebastian Krahmer 2011-08-23 09:38:06 UTC --- LightDM has some issues (even without looking at the DBUS code) where it for example is vulnerable to race condition exploits. It chowns ressource files inside users homedir like this: /* Update the users .dmrc */ if (user) { path = g_build_filename (user_get_home_directory (user), ".dmrc", NULL); g_file_set_contents (path, data, length, NULL); if (getuid () == 0 && chown (path, user_get_uid (user), user_get_gid (user)) < 0) g_warning ("Error setting ownership on %s: %s", path, strerror (errno)); g_free (path); } Failing to realize symlinks etc. There is more code like this (and I am going to report it to oss-sec) as well as integer overflows. Unless lightdm has undergone a serious security review I'd not recommend its usage. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=708205 https://bugzilla.novell.com/show_bug.cgi?id=708205#c7 Sebastian Krahmer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution| |WONTFIX --- Comment #7 from Sebastian Krahmer 2011-08-30 08:10:35 UTC --- Upstream is tracking it here: https://bugs.launchpad.net/lightdm/+bug/834079 So I am closing this one as "done". -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=708205 https://bugzilla.novell.com/show_bug.cgi?id=708205#c9 --- Comment #9 from Guido Berhörster 2011-09-16 07:51:35 UTC --- (In reply to comment #8)

overwriting files got CVE-2011-3349

I'm aware of it, a fix is in 0.9.6, I'll take care of the update next week since I'm currently on vacation. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=708205 https://bugzilla.novell.com/show_bug.cgi?id=708205#c Thomas Biege changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|AUDIT-0: lightdm |VUL-0: lightdm: overwriting | |files -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=708205 https://bugzilla.novell.com/show_bug.cgi?id=708205#c12 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |FIXED --- Comment #12 from Ludwig Nussel 2012-03-12 14:13:57 CET --- the bug is fixed in 12.1 already -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.