From 18f90aa9bce897c252629c8485d0c4cc07aa09a3 Mon Sep 17 00:00:00 2001
From: Colin Walters <walters@verbum.org>
Date: Wed, 20 Feb 2013 07:21:50 -0500
Subject: [PATCH] CVE-2013-0292

  Resolves: #911714
---
 ...us-gproxy-Verify-sender-of-NameOwner.patch | 51 +++++++++++++++++++
 dbus-glib.spec                                |  8 ++-
 2 files changed, 58 insertions(+), 1 deletion(-)
 create mode 100644 0001-CVE-2013-0292-dbus-gproxy-Verify-sender-of-NameOwner.patch

diff --git a/0001-CVE-2013-0292-dbus-gproxy-Verify-sender-of-NameOwner.patch b/0001-CVE-2013-0292-dbus-gproxy-Verify-sender-of-NameOwner.patch
new file mode 100644
index 0000000..b168d13
--- /dev/null
+++ b/0001-CVE-2013-0292-dbus-gproxy-Verify-sender-of-NameOwner.patch
@@ -0,0 +1,51 @@
+From 166978a09cf5edff4028e670b6074215a4c75eca Mon Sep 17 00:00:00 2001
+From: Colin Walters <walters@verbum.org>
+Date: Thu, 14 Feb 2013 10:19:34 -0500
+Subject: [PATCH] CVE-2013-0292: dbus-gproxy: Verify sender of NameOwnerChanged signals to be o.f.DBus
+
+Anyone can hop on the bus and emit a signal whose interface is
+o.f.DBus; it's expected at the moments that clients (and notably DBus
+libraries) check the sender.
+
+This could previously be used to trick a system service using dbus-glib
+into thinking a malicious signal came from a privileged source, by
+claiming that ownership of the privileged source's well-known name had
+changed from the privileged source's real unique name to the attacker's
+unique name.
+
+[altered to be NULL-safe so it won't crash on peer connections -smcv]
+Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
+Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
+---
+ dbus/dbus-gproxy.c |    7 ++++---
+ 1 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/dbus/dbus-gproxy.c b/dbus/dbus-gproxy.c
+index 2fc52f9..c3ae9ec 100644
+--- a/dbus/dbus-gproxy.c
++++ b/dbus/dbus-gproxy.c
+@@ -1250,8 +1250,11 @@ dbus_g_proxy_manager_filter (DBusConnection    *connection,
+       GSList *tmp;
+       const char *sender;
+ 
++      sender = dbus_message_get_sender (message);
++
+       /* First we handle NameOwnerChanged internally */
+-      if (dbus_message_is_signal (message,
++      if (g_strcmp0 (sender, DBUS_SERVICE_DBUS) == 0 &&
++	  dbus_message_is_signal (message,
+ 				  DBUS_INTERFACE_DBUS,
+ 				  "NameOwnerChanged"))
+ 	{
+@@ -1280,8 +1283,6 @@ dbus_g_proxy_manager_filter (DBusConnection    *connection,
+ 	    }
+ 	}
+ 
+-      sender = dbus_message_get_sender (message);
+-
+       /* dbus spec requires these, libdbus validates */
+       g_assert (dbus_message_get_path (message) != NULL);
+       g_assert (dbus_message_get_interface (message) != NULL);
+-- 
+1.7.1
+
diff --git a/dbus-glib.spec b/dbus-glib.spec
index 17ed200..01a67e3 100644
--- a/dbus-glib.spec
+++ b/dbus-glib.spec
@@ -8,7 +8,7 @@
 Summary: GLib bindings for D-Bus
 Name: dbus-glib
 Version: 0.100
-Release: 2%{?dist}
+Release: 3%{?dist}
 URL: http://www.freedesktop.org/software/dbus/
 #VCS: git:git://git.freedesktop.org/git/dbus/dbus-glib
 Source0: http://dbus.freedesktop.org/releases/dbus-glib/%{name}-%{version}.tar.gz
@@ -23,6 +23,8 @@ BuildRequires: libxml2-devel
 BuildRequires: glib2-devel >= %{glib2_version}
 BuildRequires: gettext
 
+Patch0: 0001-CVE-2013-0292-dbus-gproxy-Verify-sender-of-NameOwner.patch
+
 %description
 
 D-Bus add-on library to integrate the standard D-Bus library with
@@ -110,6 +112,10 @@ rm -rf %{buildroot}
 %endif
 
 %changelog
+* Wed Feb 20 2013 Colin Walters <walters@redhat.com> - 0.100-3
+- CVE-2013-0292
+  Resolves: #911714
+
 * Wed Feb 13 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.100-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild