PT-2014-1921 · Freedesktop.Org+3 · D-Bus+3

CVE-2014-3477 · Publicado 2014-06-18 · Atualizado 2025-01-16

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions D-Bus versions 1.2.x through 1.4.x D-Bus versions 1.6.x before 1.6.20 D-Bus versions 1.8.x before 1.8.10

Description The issue allows local users to cause a denial of service or possibly conduct a side-channel attack via a D-Bus message to an inactive service. This occurs because the dbus-daemon sends an AccessDenied error to the service instead of the client when access is prohibited. Exploitation of the vulnerabilities may lead to disruption of confidentiality, integrity, and availability of protected information and can be performed remotely.

Recommendations For D-Bus versions 1.2.x through 1.4.x, update to a version after 1.4.x. For D-Bus versions 1.6.x before 1.6.20, update to version 1.6.20 or later. For D-Bus versions 1.8.x before 1.8.10, update to version 1.8.10 or later.

Correção

Identificadores relacionados

ALT-PU-2014-1798

BDU:2015-09788

CVE-2014-3477

DLA-87-1

DSA-2971-1

MGASA-2014-0266

OPENSUSE-SU-2024:10517-1

SUSE-SU-2014_0846-1

USN-2275-1

Produtos afetados

Alt Linux

D-Bus

Suse

Ubuntu

Referências · 56

• https://errata.altlinux.org/ALT-PU-2014-1798 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-3477 · Aviso do Fabricante
• https://t.me/cvenotify/65225 · Publicação no Telegram
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html · Aviso do Fabricante
• http://support.novell.com/security/cve/CVE-2014-3477.html · Nota
• http://lists.opensuse.org/opensuse-updates/2014-06/msg00042.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-2168 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3477 · Nota de Segurança
• http://secunia.com/advisories/59428 · Nota
• https://advisories.mageia.org/MGASA-2014-0266.html · Nota de Segurança
• https://suse.com/security/cve/CVE-2014-3533 · Nota
• https://suse.com/security/cve/CVE-2015-0245 · Nota
• http://lists.opensuse.org/opensuse-updates/2014-07/msg00012.html · Aviso do Fabricante
• http://lists.freedesktop.org/archives/dbus/2014-June/016220.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3533 · Nota de Segurança