dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.

The remote NewStart CGSL host, running version MAIN 6.02, has dbus packages installed that are affected by multiple vulnerabilities:

  - Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows     local applications to remove match rules for other applications and cause a denial of service (lost     process messages). (CVE-2006-6107)

  - dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow     directives in the security policy only for fully qualified method calls, which allows local users to     bypass intended access restrictions via a method call with a NULL interface. (CVE-2008-0595)

  - The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before     1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature     via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834. (CVE-2009-1189)

  - libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other     products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS     environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications     that do not cleanse environment variables, not in libdbus itself: we do not support use of libdbus in     setuid binaries that do not sanitize their environment before their first call into libdbus.
    (CVE-2012-3524)

  - The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before     1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service     (service crash) via a crafted message. (CVE-2013-2168)

  - The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an     AccessDenied error to the service instead of a client when the client is prohibited from accessing the     service, which allows local users to cause a denial of service (initialization failure and exit) or     possibly conduct a side-channel attack via a D-Bus message to an inactive service. (CVE-2014-3477)

  - dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service     (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message     containing an invalid file descriptor. (CVE-2014-3533)

  - Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a     64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a     denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file     descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.
    (CVE-2014-3635)

  - D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of     service (prevention of new connections and connection drop) by queuing the maximum number of file     descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more     than the allowed number of file descriptors for a single sendmsg call. (CVE-2014-3636)

  - D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for     processes that have terminated, which allows local users to cause a denial of service via a D-bus message     containing a D-Bus connection file descriptor. (CVE-2014-3637)

  - The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8     allows local users to cause a denial of service (CPU consumption) via a large number of method calls.
    (CVE-2014-3638)

  - The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections,     which allows local users to cause a denial of service (incomplete connection consumption and prevention of     new connections) via a large number of incomplete connections. (CVE-2014-3639)

  - D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to     cause a denial of service (prevention of new connections and connection drop) by queuing the maximum     number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2014-3636.1. (CVE-2014-7824)

  - D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate     the source of ActivationFailure signals, which allows local users to cause a denial of service (activation     failure error returned) by leveraging a race condition involving sending an ActivationFailure signal     before systemd responds. (CVE-2015-0245)

  - An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-     daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local     attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use     this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus     clients. (CVE-2020-12049)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

6 vulnerabilities were discovered for the dbus-1 and dbus-1-x11 packages in openSUSE versions 11.4, 12.1, and 12.2.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2008-0159 advisory.

    [1.0.0-6.3.el5_1]
     - CVE-2008-0595: D-Bus security policy circumvention
     - Resolves: #432437

     [1.0.0-6.el5_1]
     - CVE-2006-6107: D-Bus denial of service
     - Resolves: #219601

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Havoc Pennington discovered a flaw in the way the dbus-daemon applies its security policy. A user with the ability to connect to the dbus-daemon may be able to execute certain method calls they should normally not have permission to access. (CVE-2008-0595)

Updated dbus packages that fix an issue with circumventing the security policy are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

D-Bus is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility.

Havoc Pennington discovered a flaw in the way the dbus-daemon applies its security policy. A user with the ability to connect to the dbus-daemon may be able to execute certain method calls they should normally not have permission to access. (CVE-2008-0595)

Red Hat does not ship any applications in Red Hat Enterprise Linux 5 that would allow a user to leverage this flaw to elevate their privileges.

This flaw does not affect the version of D-Bus shipped in Red Hat Enterprise Linux 4.

All users are advised to upgrade to these updated dbus packages, which contain a backported patch and are not vulnerable to this issue.

Havoc Pennington discovered that the D-Bus daemon did not correctly validate certain security policies. If a local user sent a specially crafted D-Bus request, they could bypass security policies that had a 'send_interface' defined. (CVE-2008-0595)

It was discovered that the D-Bus library did not correctly validate certain corrupted signatures. If a local user sent a specially crafted D-Bus request, they could crash applications linked against the D-Bus library, leading to a denial of service. (CVE-2008-3834).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was discovered by Havoc Pennington in how the dbus-daemon applied its security policy. A user with the ability to connect to the dbus-daemon could possibly execute certain method calls that they should not normally have access to.

The updated packages have been patched to correct these issues.

Users will have to reboot the system once these packages have been installed in order to prevent problems due to service dependencies on the messagebus service.

Havoc Pennington discovered that DBus, a simple interprocess messaging system, performs insufficient validation of security policies, which might allow local privilege escalation.

This update of dbus-1 fixes a vulnerability caused by applying the policies incorrectly. (CVE-2008-0595)

- Wed Feb 27 2008 David Zeuthen <davidz at redhat.com> -     1.1.2-9.fc8

    - CVE-2008-0595

    - Thu Oct 25 2007 Bill Nottingham <notting at       redhat.com> - 1.1.2-8

    - have -libs obsolete older versions of the main package       so that yum upgrades work

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Feb 27 2008 David Zeuthen <davidz at redhat.com> -     1.0.2-7.fc7

    - CVE-2008-0595

    - Fri Jun 22 2007 Matthias Clasen <mclasen at       redhat.com> - 1.0.2-6

    - Don't require libxml-python needlessly (#245300)

    - Sun Jun 17 2007 Matthias Clasen <mclasen at       redhat.com> - 1.0.2-5

    - Require pkgconfig in -devel, not in -x11 (#244385)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
167488	NewStart CGSL MAIN 6.02 : dbus Multiple Vulnerabilities (NS-SA-2022-0093)	Nessus	NewStart CGSL Local Security Checks	medium
74795	openSUSE Security Update : dbus-1 / dbus-1-x11 (openSUSE-SU-2012:1418-1)	Nessus	SuSE Local Security Checks	medium
67662	Oracle Linux 5 : Moderate: / dbus (ELSA-2008-0159)	Nessus	Oracle Linux Local Security Checks	high
60365	Scientific Linux Security Update : dbus on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43675	CentOS 5 : dbus (CESA-2008:0159)	Nessus	CentOS Local Security Checks	medium
36805	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : dbus vulnerabilities (USN-653-1)	Nessus	Ubuntu Local Security Checks	medium
36700	Mandriva Linux Security Advisory : dbus (MDVSA-2008:054)	Nessus	Mandriva Local Security Checks	medium
33367	Debian DSA-1599-1 : dbus - programming error	Nessus	Debian Local Security Checks	medium
31396	SuSE 10 Security Update : dbus-1 (ZYPP Patch Number 5050)	Nessus	SuSE Local Security Checks	medium
31395	openSUSE 10 Security Update : dbus-1 (dbus-1-5049)	Nessus	SuSE Local Security Checks	medium
31315	Fedora 8 : dbus-1.1.2-9.fc8 (2008-2070)	Nessus	Fedora Local Security Checks	medium
31312	Fedora 7 : dbus-1.0.2-7.fc7 (2008-2043)	Nessus	Fedora Local Security Checks	medium
31308	RHEL 5 : dbus (RHSA-2008:0159)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2008-0595

high

Tenable Plugins

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium