This page tracks the changes needed to fix [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503532 D-Bus deny-by-default].

[http://people.debian.org/~smcv/dbus-cve-2008-4311/ "Release candidate" of dbus source and i386 binaries for testing]

http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=pkg-utopia-maintainers@lists.alioth.debian.org&tag=CVE-2008-4311

(some of these may be non-RC)

fd.o #18961

Bugs which are probably not RC, related to [http://bugs.freedesktop.org/show_bug.cgi?id=18961 fd.o #18961]:

http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=pkg-utopia-maintainers@lists.alioth.debian.org&tag=fdo-18961

Otherwise broken

libosso, osso-gwconnect (RM requested)

NM-0.7: http://bugzilla.gnome.org/show_bug.cgi?id=565008

dbus-glib: http://bugs.freedesktop.org/show_bug.cgi?id=19441

Complete list of affected packages

Fixed packages

bluemon

(#510626, fixed in 1.4-5, looks ok)

bluez-utils

(#510644, fixed in 3.36-3, seems ok, bare send_interfaces though, limitation of bluez architecture

consolekit

(#510645, fixed in 0.2.10-4, looks ok)

hal

(#510639, fixed in 0.5.11-7, mostly ok, cleanup default section)

odccm

(#510788, fixed in 0.11.1-4, looks mostly ok, restrict to interfaces?)

policykit

(#510646, fixed in 0.9-2, looks ok)

pommed

(#510700, fixed in 1.25~dfsg-1, looks mostly ok, allows access to everyone?)

smart-notifier

(#510709, fixed in 0.28-1.1, looks ok, strict)

sugar

(#510657, fixed in 0.82.8-3, looks ok)

system-tools-backends

(#510744, fixed in 2.6.0-2lenny1, looks ok, strict)

Packages with bug report not yet fixed

avahi-daemon

(#510653, no patch)

cups

(#510634, no patch)

dhcdbd

(#510791, no patch, bare send_interfaces, superfluous default section)

dnsmasq

(#510649, patch via upstream bug report)

galago-daemon

(#511146, request to remove system bus policy file)

network-manager

(#510729, no patch)

network-manager-gnome

(#510728, no patch)

network-manager-kde

(#510757, no patch)

network-manager-openvpn

(#510730, no patch)

network-manager-pptp

(#510732, no patch)

network-manager-vpnc

(#510735, no patch)

pathfinderd

(#510696, no patch, remove bare send_interfaces and default section)

powersaved

(#510633, patch seems ok, move introspection in default section!)

system-config-printer

(#510756, no patch, superfluous default section, remove send_interface)

wpasupplicant

(#510652, patch, denials with NM 0.7)

yum

(#510659, no patch, remove bare send_interfaces, default section)

Packages without a bug report

gconf-defaults-service

(from experimental, bare send_interfaceS)

gnome-applets-data

(from experimental, bare send_interfaceS)

gnome-panel-data

(from experimental, bare send_interfaceS)

gpe-bluetooth

(no bug report filed)

kerneloops

(completely broken, file extension does not even end with .conf)

libgksu-polkit0

(looks mostly ok)

libpam-dbus

(not sure, allow everyone to own the name)

mumble-server

(looks ok)

osso-gwconnect

(bare send_interfaceS, needs review)

setroubleshoot

(bare send_interfaceS, needs review)

wicd

(bare send_interfaceS, needs review, allows everyone to configure the network?)