Executive Summary
| Summary | |
|---|---|
| Title | dbus security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2008:0159 | First vendor Publication | 2008-02-27 |
| Vendor | RedHat | Last vendor Modification | 2008-02-27 |
| Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.6 | Attack Range | Local |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated dbus packages that fix an issue with circumventing the security policy are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: D-Bus is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility. Havoc Pennington discovered a flaw in the way the dbus-daemon applies its security policy. A user with the ability to connect to the dbus-daemon may be able to execute certain method calls they should normally not have permission to access. (CVE-2008-0595) Red Hat does not ship any applications in Red Hat Enterprise Linux 5 that would allow a user to leverage this flaw to elevate their privileges. This flaw does not affect the version of D-Bus shipped in Red Hat Enterprise Linux 4. All users are advised to upgrade to these updated dbus packages, which contain a backported patch and are not vulnerable to this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 432419 - CVE-2008-0595 dbus security policy circumvention |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2008-0159.html |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:20329 | |||
| Oval ID: | oval:org.mitre.oval:def:20329 | ||
| Title: | DSA-1599-1 dbus | ||
| Description: | Havoc Pennington discovered that DBus, a simple interprocess messaging system, performs insufficient validation of security policies, which might allow local privilege escalation. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1599-1 CVE-2008-0595 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | dbus |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22397 | |||
| Oval ID: | oval:org.mitre.oval:def:22397 | ||
| Title: | ELSA-2008:0159: dbus security update (Moderate) | ||
| Description: | dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2008:0159-01 CVE-2008-0595 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | dbus |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:8119 | |||
| Oval ID: | oval:org.mitre.oval:def:8119 | ||
| Title: | DSA-1599 dbus -- programming error | ||
| Description: | Havoc Pennington discovered that DBus, a simple interprocess messaging system, performs insufficient validation of security policies, which might allow local privilege escalation. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1599 CVE-2008-0595 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | dbus |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9353 | |||
| Oval ID: | oval:org.mitre.oval:def:9353 | ||
| Title: | dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface. | ||
| Description: | dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-0595 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-04-09 | Name : Mandriva Update for dbus MDVSA-2008:054 (dbus) File : nvt/gb_mandriva_MDVSA_2008_054.nasl |
| 2009-03-23 | Name : Ubuntu Update for dbus vulnerabilities USN-653-1 File : nvt/gb_ubuntu_USN_653_1.nasl |
| 2009-03-06 | Name : RedHat Update for dbus RHSA-2008:0159-01 File : nvt/gb_RHSA-2008_0159-01_dbus.nasl |
| 2009-02-16 | Name : Fedora Update for dbus FEDORA-2008-2043 File : nvt/gb_fedora_2008_2043_dbus_fc7.nasl |
| 2009-02-16 | Name : Fedora Update for dbus FEDORA-2008-2070 File : nvt/gb_fedora_2008_2070_dbus_fc8.nasl |
| 2008-07-07 | Name : Debian Security Advisory DSA 1599-1 (dbus) File : nvt/deb_1599_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 43038 | D-Bus dbus-daemon send_interface Local Security Policy Bypass |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-750.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0159.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080227_dbus_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0159.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-054.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-653-1.nasl - Type : ACT_GATHER_INFO |
| 2008-07-02 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1599.nasl - Type : ACT_GATHER_INFO |
| 2008-03-07 | Name : The remote openSUSE host is missing a security update. File : suse_dbus-1-5049.nasl - Type : ACT_GATHER_INFO |
| 2008-03-07 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_dbus-1-5050.nasl - Type : ACT_GATHER_INFO |
| 2008-02-29 | Name : The remote Fedora host is missing a security update. File : fedora_2008-2043.nasl - Type : ACT_GATHER_INFO |
| 2008-02-29 | Name : The remote Fedora host is missing a security update. File : fedora_2008-2070.nasl - Type : ACT_GATHER_INFO |
| 2008-02-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0159.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:51:28 |
|
