Bug 18559

Summary:	libimobiledevice and libusbmuxd new security issue CVE-2016-5104
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	brtians1, herman.viaene, sysadmin-bugs
Version:	5	Keywords:	validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/689258/
Whiteboard:	has_procedure advisory MGA5-64-OK MGA5-32-OK
Source RPM:	libimobiledevice-1.1.6-4.mga5.src.rpm, usbmuxd-1.0.9-6.mga5.src.rpm	CVE:
Status comment:

Description David Walser 2016-05-27 15:40:22 CEST

A CVE has been assigned for a security issue fixed upstream in libimobiledevice and libusbmuxd.  The fix was committed in git on December 29 and the CVE was assigned on May 26:
http://www.openwall.com/lists/oss-security/2016/05/26/6

Patched packages uploaded for Mageia 5 and Cauldron.

Advisory:
========================

Updated libimobiledevice and usbmuxd package fixes security vulnerability:

The libimobiledevice and libusbmuxd libraries open a socket that listens on all
available network interfaces, rather than just the loopback interface as was
intended (CVE-2016-5104).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5104
http://www.openwall.com/lists/oss-security/2016/05/26/6
========================

Updated packages in core/updates_testing:
========================
libimobiledevice-1.1.6-4.1.mga5
libimobiledevice4-1.1.6-4.1.mga5
libimobiledevice-devel-1.1.6-4.1.mga5
python-imobiledevice-1.1.6-4.1.mga5
usbmuxd-1.0.9-6.1.mga5
libusbmuxd2-1.0.9-6.1.mga5
libusbmuxd-devel-1.0.9-6.1.mga5

from SRPMS:
libimobiledevice-1.1.6-4.1.mga5.src.rpm
usbmuxd-1.0.9-6.1.mga5.src.rpm

Comment 1 Herman Viaene 2016-05-31 15:23:40 CEST

MGA5-32 on AcerD620 Xfce.
No installation issues, does not seem to break anything, but I won't buy Apple stuff to test it. Someone else???

CC: (none) => herman.viaene

David Walser 2016-06-01 13:21:37 CEST

URL: (none) => http://lwn.net/Vulnerabilities/689258/

Comment 2 David Walser 2016-06-07 16:31:29 CEST

rpmdiff's on madb show patches correctly applied.  Please verify that the packages upgrade cleanly and OK this.

Comment 3 Brian Rockwell 2016-06-12 20:33:34 CEST

Installed the updates

The following 3 packages are going to be installed:

- lib64usbmuxd2-1.0.9-6.1.mga5.x86_64
- libimobiledevice-1.1.6-4.1.mga5.x86_64
- python-imobiledevice-1.1.6-4.1.mga5.x86_64

I'll see if I can get it to talk to my iphone6

CC: (none) => brtians1

Comment 4 Brian Rockwell 2016-06-13 02:23:20 CEST

I tried connecting to iphone 6, ipod touch 6.  Both are seen by shotwell, but neither will transfer pictures or video even when approved.

Not sure what to see.  If I find a cord for an ipod 4, i'll try that.

Comment 5 claire robinson 2016-06-13 09:44:18 CEST

Possibly needs usbmuxd too Brian. Failing that, maybe lib64mtp9?

Comment 6 claire robinson 2016-06-13 09:47:33 CEST

Also, was it working before the update?

Comment 7 Brian Rockwell 2016-06-13 17:46:10 CEST

I tried this on an not updated KDE system (the one failing is GNOME) and it did work properly.

it immediately recognized the iphone 6 and allowed me to view open the photos.

Comment 8 Brian Rockwell 2016-06-13 18:11:14 CEST

okay installed usbmuxd 1.0.9-6.1 and it started working.

Approved as working.

Whiteboard: (none) => MGA5-64-OK

Comment 9 Brian Rockwell 2016-06-18 17:38:31 CEST

Linux localhost 4.4.13-desktop-1.mga5 #1 SMP Fri Jun 10 14:05:25 UTC 2016 i686 i686 i686 GNU/Linux


The following 5 packages are going to be installed:

- libimobiledevice-1.1.6-4.1.mga5.i586
- libimobiledevice4-1.1.6-4.1.mga5.i586
- libusbmuxd2-1.0.9-6.1.mga5.i586
- python-imobiledevice-1.1.6-4.1.mga5.i586
- usbmuxd-1.0.9-6.1.mga5.i586

587KB of additional disk space will be used.

338KB of packages will be retrieved.


I also installed Shotwell (this is a Mate desktop).

Shotwell was able to access the iphone 6 pictures with new drivers.

These updates are good.

Whiteboard: MGA5-64-OK => MGA5-64-OK MGA5-32-OK

Brian Rockwell 2016-06-18 17:39:49 CEST

CC: (none) => sysadmin-bugs
Keywords: (none) => validated_update

Comment 10 claire robinson 2016-06-22 16:00:56 CEST

Advisory uploaded.

Whiteboard: MGA5-64-OK MGA5-32-OK => has_procedure advisory MGA5-64-OK MGA5-32-OK

Comment 11 Mageia Robot 2016-06-22 18:37:20 CEST

An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2016-0229.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED