Executive Summary
| Summary | |
|---|---|
| Title | Updated dbus packages fix vulnerability |
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2008:054 | First vendor Publication | 2008-02-28 |
| Vendor | Mandriva | Last vendor Modification | 2008-02-28 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.6 | Attack Range | Local |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A vulnerability was discovered by Havoc Pennington in how the dbus-daemon applied its security policy. A user with the ability to connect to the dbus-daemon could possibly execute certain method calls that they should not normally have access to. The updated packages have been patched to correct these issues. Users will have to reboot the system once these packages have been installed in order to prevent problems due to service dependencies on the messagebus service. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2008:054 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:20329 | |||
| Oval ID: | oval:org.mitre.oval:def:20329 | ||
| Title: | DSA-1599-1 dbus | ||
| Description: | Havoc Pennington discovered that DBus, a simple interprocess messaging system, performs insufficient validation of security policies, which might allow local privilege escalation. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1599-1 CVE-2008-0595 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | dbus |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22397 | |||
| Oval ID: | oval:org.mitre.oval:def:22397 | ||
| Title: | ELSA-2008:0159: dbus security update (Moderate) | ||
| Description: | dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2008:0159-01 CVE-2008-0595 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | dbus |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:8119 | |||
| Oval ID: | oval:org.mitre.oval:def:8119 | ||
| Title: | DSA-1599 dbus -- programming error | ||
| Description: | Havoc Pennington discovered that DBus, a simple interprocess messaging system, performs insufficient validation of security policies, which might allow local privilege escalation. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1599 CVE-2008-0595 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | dbus |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9353 | |||
| Oval ID: | oval:org.mitre.oval:def:9353 | ||
| Title: | dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface. | ||
| Description: | dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-0595 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-04-09 | Name : Mandriva Update for dbus MDVSA-2008:054 (dbus) File : nvt/gb_mandriva_MDVSA_2008_054.nasl |
| 2009-03-23 | Name : Ubuntu Update for dbus vulnerabilities USN-653-1 File : nvt/gb_ubuntu_USN_653_1.nasl |
| 2009-03-06 | Name : RedHat Update for dbus RHSA-2008:0159-01 File : nvt/gb_RHSA-2008_0159-01_dbus.nasl |
| 2009-02-16 | Name : Fedora Update for dbus FEDORA-2008-2043 File : nvt/gb_fedora_2008_2043_dbus_fc7.nasl |
| 2009-02-16 | Name : Fedora Update for dbus FEDORA-2008-2070 File : nvt/gb_fedora_2008_2070_dbus_fc8.nasl |
| 2008-07-07 | Name : Debian Security Advisory DSA 1599-1 (dbus) File : nvt/deb_1599_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 43038 | D-Bus dbus-daemon send_interface Local Security Policy Bypass |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-750.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0159.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080227_dbus_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0159.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-054.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-653-1.nasl - Type : ACT_GATHER_INFO |
| 2008-07-02 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1599.nasl - Type : ACT_GATHER_INFO |
| 2008-03-07 | Name : The remote openSUSE host is missing a security update. File : suse_dbus-1-5049.nasl - Type : ACT_GATHER_INFO |
| 2008-03-07 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_dbus-1-5050.nasl - Type : ACT_GATHER_INFO |
| 2008-02-29 | Name : The remote Fedora host is missing a security update. File : fedora_2008-2043.nasl - Type : ACT_GATHER_INFO |
| 2008-02-29 | Name : The remote Fedora host is missing a security update. File : fedora_2008-2070.nasl - Type : ACT_GATHER_INFO |
| 2008-02-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0159.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:39:15 |
|
