PT-2011-1152 · Freedesktop.Org+1 · D-Bus+1

Jan Lieskovsky · Published 2011-06-22 · Updated 2023-12-27 · CVE-2011-2200

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions D-Bus versions 1.2.x through 1.2.27 D-Bus versions 1.4.x through 1.4.11 D-Bus versions 1.5.x through 1.5.3

Description The issue concerns a problem with handling non-native byte order in the dbus header byteswap function, which can be exploited locally. This exploitation can lead to a denial of service, potentially sensitive information disclosure, or unspecified state-modification attacks via crafted messages.

Recommendations For D-Bus versions 1.2.x through 1.2.27, update to version 1.2.28 or later. For D-Bus versions 1.4.x through 1.4.11, update to version 1.4.12 or later. For D-Bus versions 1.5.x through 1.5.3, update to version 1.5.4 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-399

CWE-20

Related Identifiers

BDU:2015-09422

CVE-2011-2200

RHSA-2011:1132

RHSA-2011_1132

Affected Products

D-Bus

Red Hat

References · 26

• https://osv.dev/vulnerability/CVE-2011-2200 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=712676 · Patch
• https://bdu.fstec.ru/vul/2015-09422 · Security Note
• https://linux.oracle.com/errata/ELSA-2011-1132.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-2200 · Vendor Advisory
• http://secunia.com/advisories/44896 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/06/13/12 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-2200 · Security Note
• http://cgit.freedesktop.org/dbus/dbus/commit/?h=dbus-1.4&id=c3223ba6c401ba81df1305851312a47c485e6cd7 · Patch
• http://redhat.com/support/errata/RHSA-2011-1132.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/06/12/1 · Patch
• http://cgit.freedesktop.org/dbus/dbus/commit/?h=dbus-1.2&id=6519a1f77c61d753d4c97efd6e15630eb275336e · Patch
• http://cgit.freedesktop.org/dbus/dbus/tree/NEWS?h=dbus-1.2 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2200 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201110-14.xml · Note