PT-2015-7930 · Freedesktop.Org · Dbus

Published 2015-10-25 · Updated 2015-10-25

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions dbus (affected versions not specified)

Description The issue concerns security hardening and bug fixes in dbus. On Unix platforms, the default configuration for the session bus has been changed to only allow EXTERNAL authentication, avoiding the fallback to DBUS COOKIE SHA1, which relies on strongly unpredictable pseudo-random numbers. This change mitigates potential security risks under certain circumstances, such as when /dev/urandom is unreadable or malloc() returns NULL. Additionally, several bugs have been fixed, including a memory leak when GetConnectionCredentials() succeeds, and issues with dbus-monitor, DBusCounter, DBusTransport, and DBusServer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2015-0405

Affected Products

Dbus

References · 10

• https://advisories.mageia.org/MGASA-2015-0405.html · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0405 · Vendor Advisory
• https://bugs.freedesktop.org/show_bug.cgi?id=90952 · Note
• http://cgit.freedesktop.org/dbus/dbus/plain/NEWS?h=dbus-1.8 · Note
• https://bugs.freedesktop.org/show_bug.cgi?id=90021 · Note
• https://bugs.freedesktop.org/show_bug.cgi?id=89297 · Note
• https://bugs.freedesktop.org/show_bug.cgi?id=90312 · Note
• https://bugs.freedesktop.org/show_bug.cgi?id=90414 · Note
• https://bugs.freedesktop.org/show_bug.cgi?id=91008 · Note
• https://bugs.mageia.org/show_bug.cgi?id=15937 · Note