#726645 dbus: tiger reports vulnerability with dbus-daemon-launch-helper

Package:
dbus
Source:
dbus
Description:
simple interprocess messaging system (system message bus)
Submitter:
Ian Bolton
Date:
2013-10-18 08:33:05 UTC
Severity:
normal
#726645#5
Date:
2013-10-17 16:43:17 UTC
From:
To:
The tiger script check_suid  does the equivalent of:

strings dbus-daemon-launch-helper | grep -E '\.\./'

And finds:

../../dbus/dbus-connection.c
../../dbus/dbus-errors.c
../../dbus/dbus-message.c
../../dbus/dbus-pending-call.c
../../dbus/dbus-signature.c
../../dbus/dbus-watch.c
../../dbus/dbus-bus.c
../../dbus/dbus-server.c

Please remove these strings.
Thanks,
Ian
#726645#10
Date:
2013-10-18 08:31:52 UTC
From:
To:
...

This tool is presumably looking for attempts to read, write or execute
relative paths. This output looks very much like a false positive: the
strings appear in debug or warning messages to identify the module
emitting the message.

    S