CVE-2013-0292: dbus-gproxy: Verify sender of NameOwnerChanged signals to be o.f.DBus

Anyone can hop on the bus and emit a signal whose interface is
o.f.DBus; it's expected at the moments that clients (and notably DBus
libraries) check the sender.

This could previously be used to trick a system service using dbus-glib
into thinking a malicious signal came from a privileged source, by
claiming that ownership of the privileged source's well-known name had
changed from the privileged source's real unique name to the attacker's
unique name.

[altered to be NULL-safe so it won't crash on peer connections -smcv]
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>

0 files changed, 0 insertions, 0 deletions