- why does this daemon need to run as root?
- org.freedesktop.color-manager.modify-profile appears to read any file on the
filesystem. It reads the entire file (e.g. DoS with /dev/zero), and might do
something via lcms parsing, but I haven't examined what sort of issues are in
lcms for reading arbitrary files.
- by default, SearchVolumes is true in the /etc conf file, which means every
inserted volume will be searched for color profiles, meaning that the above
issue is true for arbitrary volume mounts too (attacker wouldn't need dbus
access even).
** Changed in: colord (Ubuntu)
Status: Confirmed => Incomplete
** Changed in: colord (Ubuntu)
Assignee: Kees Cook (kees) => (unassigned)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/823185
Title:
[MIR] colord
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/colord/+bug/823185/+subscriptions
--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
