PT-2015-7930 · Freedesktop.Org · Dbus

Publicado 2015-10-25 · Atualizado 2015-10-25

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions dbus (affected versions not specified)

Description The issue concerns security hardening and bug fixes in dbus. On Unix platforms, the default configuration for the session bus has been changed to only allow EXTERNAL authentication, avoiding the fallback to DBUS COOKIE SHA1, which relies on strongly unpredictable pseudo-random numbers. This change mitigates potential security risks under certain circumstances, such as when /dev/urandom is unreadable or malloc() returns NULL. Additionally, several bugs have been fixed, including a memory leak when GetConnectionCredentials() succeeds, and issues with dbus-monitor, DBusCounter, DBusTransport, and DBusServer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

MGASA-2015-0405

Produtos afetados

Dbus

Referências · 10

• https://advisories.mageia.org/MGASA-2015-0405.html · Nota de Segurança
• https://bugs.freedesktop.org/show_bug.cgi?id=90952 · Nota
• http://cgit.freedesktop.org/dbus/dbus/plain/NEWS?h=dbus-1.8 · Nota
• https://bugs.freedesktop.org/show_bug.cgi?id=90021 · Nota
• https://bugs.freedesktop.org/show_bug.cgi?id=89297 · Nota
• https://bugs.freedesktop.org/show_bug.cgi?id=90312 · Nota
• https://bugs.freedesktop.org/show_bug.cgi?id=90414 · Nota
• https://bugs.freedesktop.org/show_bug.cgi?id=91008 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=15937 · Nota
• https://osv.dev/vulnerability/MGASA-2015-0405 · Aviso do Fabricante