CVE-2011-2200 The _dbus_header_byteswap function in dbus-marshal-header.c in D-Bus (aka DBus) 1.2.x before 1.2.28, 1.4.x before 1.4.12, and 1.5.x before 1.5.4 does not properly handle a non-native byte order, which...
MediumCVSS 4.6
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The _dbus_header_byteswap function in dbus-marshal-header.c in D-Bus (aka DBus) 1.2.x before 1.2.28, 1.4.x before 1.4.12, and 1.5.x before 1.5.4 does not properly handle a non-native byte order, which allows local users to cause a denial of service (connection loss), obtain potentially sensitive information, or conduct unspecified state-modification attacks via crafted messages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/dbus(Debian:12) | < 1.4.12-1 | 1.4.12-1 |
| debian/dbus(Debian:13) | < 1.4.12-1 | 1.4.12-1 |
| debian/dbus(Debian:14) | < 1.4.12-1 | 1.4.12-1 |
| freedesktop dbus | = 1.5.0 | No fix listed |
| freedesktop dbus | = 1.5.2 | No fix listed |
| freedesktop dbus | = 1.4.0 | No fix listed |
| freedesktop dbus | = 1.4.1 | No fix listed |
| freedesktop dbus | = 1.4.4 | No fix listed |
| freedesktop dbus | = 1.4.6 | No fix listed |
| freedesktop dbus | = 1.4.8 | No fix listed |
| freedesktop dbus | = 1.4.10 | No fix listed |
| freedesktop dbus | = 1.2.1 | No fix listed |
| freedesktop dbus | = 1.2.2 | No fix listed |
| freedesktop dbus | = 1.2.3 | No fix listed |
| freedesktop dbus | = 1.2.4 | No fix listed |
| freedesktop dbus | = 1.2.6 | No fix listed |
| freedesktop dbus | = 1.2.8 | No fix listed |
| freedesktop dbus | = 1.2.10 | No fix listed |
| freedesktop dbus | = 1.2.12 | No fix listed |
| freedesktop dbus | = 1.2.14 | No fix listed |
| freedesktop dbus | = 1.2.16 | No fix listed |
| freedesktop dbus | = 1.2.18 | No fix listed |
| freedesktop dbus | = 1.2.20 | No fix listed |
| freedesktop dbus | = 1.2.22 | No fix listed |
| freedesktop dbus | = 1.2.24 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| freedesktop dbus | = 1.2.26 | No fix listed |
| d-bus project d-bus | = 1.2.4.2 | No fix listed |
| d-bus project d-bus | = 1.2.4.4 | No fix listed |
| d-bus project d-bus | = 1.2.4.6 | No fix listed |
References
- Debian Security Tracker CVE-2011-2200 vendor-advisory
- bugs.debian.org
- cgit.freedesktop.org patch
- cgit.freedesktop.org patch
- cgit.freedesktop.org patch
- cgit.freedesktop.org
- kb.juniper.net
- [dbus] 20070317 D-Bus daemon endianness issue mailing-list
- [dbus] 20110530 D-Bus daemon big and little endian issue mailing-list
- [oss-security] 20110612 CVE Request -- dbus -- Local DoS via messages with non-native byte order mailing-list patch
- [oss-security] 20110612 Bug#629938: Info received (CVE Request -- dbus -- Local DoS via messages with non-native byte order) mailing-list
- [oss-security] 20110613 Re: CVE Request -- dbus -- Local DoS via messages with non-native byte order mailing-list patch
- 44896 third-party-advisory vendor-advisory
- RHSA-2011:1132 vendor-advisory
- bugs.freedesktop.org
- bugzilla.redhat.com patch
- dbus-nonnative-dos(67974) vdb-entry
- bugs.debian.org issue-tracking