PT-2013-1062 · Freedesktop.Org · D-Bus

Published 2013-06-18 · Updated 2024-06-15 · CVE-2013-2168

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions D-Bus versions 1.4.x through 1.4.25 D-Bus versions 1.6.x through 1.6.11 D-Bus versions 1.7.x through 1.7.3

Description The issue allows local users to cause a denial of service via a crafted message, potentially disrupting the availability of protected information. This can be achieved by exploiting the dbus printf string upper bound function in dbus/dbus-sysdeps-unix.c. The exploitation can be carried out locally.

Recommendations For D-Bus versions 1.4.x through 1.4.25, update to version 1.4.26 or later. For D-Bus versions 1.6.x through 1.6.11, update to version 1.6.12 or later. For D-Bus versions 1.7.x through 1.7.3, update to version 1.7.4 or later. As a temporary workaround, consider restricting access to the dbus printf string upper bound function in dbus/dbus-sysdeps-unix.c to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-01741

BDU:2015-09737

CVE-2013-2168

DSA-2707-1

MGASA-2013-0173

OPENSUSE-SU-2024:10517-1

Affected Products

D-Bus

References · 44

• https://osv.dev/vulnerability/openSUSE-SU-2024:10517-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-June/109896.html · Vendor Advisory
• http://secunia.com/advisories/53317 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-07/msg00003.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2168 · Security Note
• http://secunia.com/advisories/53832 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:177 · Vendor Advisory
• http://debian.org/security/2013/dsa-2707 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0173 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01741 · Security Note
• https://osv.dev/vulnerability/CVE-2013-2168 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0173.html · Security Note
• https://bdu.fstec.ru/vul/2015-09737 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-2168 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2168 · Vendor Advisory