PT-2009-1011 · Freedesktop.Org+1 · D-Bus+1

Vincent Danen

·

Published

2009-04-27

·

Updated

2023-02-13

·

CVE-2009-1189

CVSS v2.0

4.6

Medium

VectorAV:L/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions D-Bus versions prior to 1.2.14 D-Bus version 1.1.2
Description The issue is due to incorrect logic used in the dbus validate signature with reason function to validate a basic type, allowing remote attackers to spoof a signature via a crafted key. This can lead to disruption of confidentiality, integrity, and availability of protected information. The vulnerability can be exploited locally.
Recommendations For D-Bus versions prior to 1.2.14, update to version 1.2.14 or later. For D-Bus version 1.1.2, consider upgrading to a newer version or applying available patches to resolve the issue. As a temporary workaround, consider restricting access to the dbus validate signature with reason function until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-02010
BDU:2015-06720
BDU:2015-06724
BDU:2015-06733
BDU:2015-06736
BDU:2015-08509
BDU:2015-08510
BDU:2015-08511
BDU:2015-08512
CVE-2009-1189
DSA-1837-1
RHSA-2010:0018
RHSA-2010_0018

Affected Products

D-Bus
Red Hat