CVE-2008-0595 dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local us...
MediumCVSS 4.6
EPSS 0.40%
- Published
- Updated
- Exploit status
- No public exploit known
Description
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fedoraproject fedora | = 7 | No fix listed |
| mandrakesoft mandrake linux | = 2007 | No fix listed |
| mandrakesoft mandrake linux | = 2007.0_x86_64 | No fix listed |
| mandrakesoft mandrake linux | = 2007.1 | No fix listed |
| mandrakesoft mandrake linux | = 2008.0 | No fix listed |
| redhat enterprise linux | = 5 | No fix listed |
| redhat enterprise linux | = 5.0 | No fix listed |
| freedesktop dbus | < 1.0.3 | 1.0.3 |
| freedesktop dbus | >= 1.1.0, < 1.1.20 | 1.1.20 |
| debian/dbus(Debian:12) | < 1.1.20-1 | 1.1.20-1 |
| debian/dbus(Debian:13) | < 1.1.20-1 | 1.1.20-1 |
| debian/dbus(Debian:14) | < 1.1.20-1 | 1.1.20-1 |
References
- [dbus] 20080227 [ANNOUNCE] CVE-2008-0595 D-Bus Security Releases - D-Bus 1.0.3 and D-Bus 1.1.20 mailing-list patch third-party-advisory
- SUSE-SR:2008:006 third-party-advisory vendor-advisory
- openSUSE-SU-2012:1418 third-party-advisory vendor-advisory
- 29148 broken-link third-party-advisory
- 29160 broken-link third-party-advisory
- 29171 broken-link third-party-advisory
- 29173 broken-link third-party-advisory
- 29281 broken-link third-party-advisory
- 29323 broken-link third-party-advisory
- 30869 broken-link third-party-advisory
- 32281 broken-link third-party-advisory
- 1019512 third-party-advisory vdb-entry
- wiki.rpath.com third-party-advisory
- wiki.rpath.com third-party-advisory
- DSA-1599 third-party-advisory vendor-advisory
- www.j5live.com third-party-advisory
- MDVSA-2008:054 broken-link vendor-advisory
- RHSA-2008:0159 third-party-advisory vendor-advisory
- 20080307 rPSA-2008-0099-1 dbus dbus-glib dbus-qt dbus-x11 broken-link mailing-list third-party-advisory vdb-entry
- 28023 patch third-party-advisory vdb-entry
- USN-653-1 third-party-advisory vendor-advisory
- ADV-2008-0694 broken-link vdb-entry
- issues.rpath.com third-party-advisory
- oval:org.mitre.oval:def:9353 broken-link signature vdb-entry
- FEDORA-2008-2043 third-party-advisory vendor-advisory
- FEDORA-2008-2070 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2008-0595 vendor-advisory