Bug 23371 - blueman new security issue fixed upstream in 2.0.6
Summary: blueman new security issue fixed upstream in 2.0.6
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA6-64-OK
Keywords: advisory, validated_update
: 23422 (view as bug list)
Depends on:
Blocks:
 
Reported: 2018-07-31 13:36 CEST by David Walser
Modified: 2018-10-26 20:48 CEST (History)
6 users (show)

See Also:
Source RPM: blueman-2.0.5-1.mga7.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2018-07-31 13:36:48 CEST
Blueman 2.0.6 has been released, fixing a polkit authorization issue:
http://openwall.com/lists/oss-security/2018/07/31/3

Mageia 6 may also be affected.
David Walser 2018-07-31 13:37:07 CEST

Whiteboard: (none) => MGA6TOO

Comment 1 Marja Van Waes 2018-07-31 16:01:57 CEST
Reassigning to all packagers collectively, because the maintainer can no longer (at least for now) contribute to Mageia. He asked last month to give his packages to "nobody".

Of course we do all hope he'll be back, and that he'll be as well as possible now.

CC: (none) => marja11
Assignee: tarakbumba => pkg-bugs

Comment 2 Bruno Cornec 2018-10-25 00:40:25 CEST
blueman-2.0.6-1.mga7 uploaded to cauldron

Status: NEW => ASSIGNED
Assignee: pkg-bugs => bruno
Version: Cauldron => 6
Whiteboard: MGA6TOO => (none)
CC: (none) => bruno

Comment 3 Bruno Cornec 2018-10-25 00:43:50 CEST
blueman-2.0.6-1.mga6 uploaded to mga6

Assignee: bruno => qa-bugs

Comment 4 David Walser 2018-10-25 00:48:39 CEST
openSUSE has issued an advisory for this on August 10:
https://lists.opensuse.org/opensuse-updates/2018-08/msg00072.html

There is more information in the SUSE bug:
https://bugzilla.suse.com/1083066
Comment 5 David Walser 2018-10-25 00:48:57 CEST
*** Bug 23422 has been marked as a duplicate of this bug. ***
Comment 6 David Walser 2018-10-25 00:51:01 CEST
Advisory:
========================

Updated blueman package fixes security vulnerability:

Flawed polkit authorization checks in blueman allowed any user with access to
the D-Bus system bus to trigger certain network configuration logic in blueman
without authentication (boo#1083066).

References:
https://lists.opensuse.org/opensuse-updates/2018-08/msg00072.html
========================

Updated packages in core/updates_testing:
========================
blueman-2.0.6-1.mga6

from blueman-2.0.6-1.mga6.src.rpm
Comment 7 Len Lawrence 2018-10-25 09:12:49 CEST
Mageia 6, x86_64

Mate, blueman-2.0.4-1.mga6
Bluetooth audio working.
$ ps aux | grep blue
root      1394  0.0  0.0  29944  4520 ?        Ss   07:34   0:00 /usr/libexec/bluetooth/bluetoothd
lcl       4930  0.0  0.3 785140 127940 ?       Sl   07:34   0:00 python /bin/blueman-applet
lcl       5165  0.0  0.0  31724  3368 ?        S    07:34   0:00 /usr/libexec/bluetooth/obexd

Ran MageiaUpdate.
$ rpm -qa | grep blueman
blueman-2.0.6-1.mga6

Restarted the bluetooth service.  rfkill state was updated.
# rfkill list
0: hci0: Bluetooth
	Soft blocked: no
	Hard blocked: no

Checked bluetooth audio with a wireless speaker.  Immediate connection to the device previously used.
$ ps aux | grep blue
lcl       4930  0.0  0.3 785396 128152 ?       Sl   07:34   0:00 python /bin/blueman-applet
lcl       5165  0.0  0.0  31724  3368 ?        S    07:34   0:00 /usr/libexec/bluetooth/obexd
lcl       9223  0.0  0.0  12292   992 pts/5    S+   08:10   0:00 grep --color blue
root     27624  0.0  0.0  29888  4252 ?        Ss   08:05   0:00 /usr/libexec/bluetooth/bluetoothd

OK for 64-bits.

CC: (none) => tarazed25

Len Lawrence 2018-10-25 09:14:46 CEST

Whiteboard: (none) => MGA6-64-OK

Comment 8 Thomas Andrews 2018-10-26 01:13:19 CEST
Validating. Advisory in Comment 6.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2018-10-26 15:52:37 CEST

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 9 Mageia Robot 2018-10-26 20:48:18 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2018-0414.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.