DBUS API doesn't prevent confined apps from passing paths to files without access

[Ken VanDine]

The DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app.

[Marc Deslauriers (mdeslaur)]

This is CVE-2015-1327

[Launchpad Janitor (janitor)]

This bug was fixed in the package content-hub - 0.0+15.04.20150331-0ubuntu1.0

---------------
content-hub (0.0+15.04.20150331-0ubuntu1.0) vivid-security; urgency=medium

  * SECURITY UPDATE: file disclosure via unchecked AppArmor profile
    (LP: #1456628)
    - debian/patches/lp1456628.patch: Don't allow exporting of files that
      aren't allowed by the source apparmor profile
    - CVE-2015-1327

 -- Ken VanDine <email address hidden> Mon, 01 Jun 2015 11:17:27 -0400

[Pat McGowan (pat-mcgowan)]

do we need to poke this into the next image?

[Launchpad Janitor (janitor)]

This bug was fixed in the package content-hub - 0.0+15.10.20150603-0ubuntu1

---------------
content-hub (0.0+15.10.20150603-0ubuntu1) wily; urgency=medium

  [ Ken VanDine ]
  * SECURITY UPDATE: file disclosure via unchecked AppArmor profile (LP:
    #1456628) Don't allow exporting of files that aren't allowed by the
    source apparmor profile CVE-2015-1327 (LP: #1456628)

 -- CI Train Bot <email address hidden> Wed, 03 Jun 2015 17:45:36 +0000

[Jamie Strandboge (jdstrand)]

This does not constitute an emergency update and as such it should follow any other criteria for OTA. It is marked Critical, so it seems a candidate, but it shouldn't be rushed (ie, it should follow landing procedures, QA signoff, etc). I think if the timing is ok with the release team, targeting OTA-4 is fine, but if it isn't, OTA-5 is ok.