CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 2CVE-2020-12049 – dbus: denial of service via file descriptor leak
https://notcve.org/view.php?id=CVE-2020-12049
An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients. Se detectó un problema en dbus versiones posteriores a 1.3.0 e incluyéndola y anteriores a 1.12.18. El DBusServer en libdbus, como es usado en dbus-daemon, filtra los descriptores de archivo cuando un mensaje excede el límite del descriptor de archivo por mensaje. • http://packetstormsecurity.com/files/172840/D-Bus-File-Descriptor-Leak-Denial-Of-Service.html http://www.openwall.com/lists/oss-security/2020/06/04/3 https://gitlab.freedesktop.org/dbus/dbus/-/issues/294 https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.10.30 https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.12.18 https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.13.16 https://security.gentoo.org/glsa/202007-46 https://securitylab.github& • CWE-400: Uncontrolled Resource Consumption CWE-404: Improper Resource Shutdown or Release •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2019-12749 – dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass
https://notcve.org/view.php?id=CVE-2019-12749
dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass. dbus anterior a versión 1.10.28, versión 1.12.x anterior a 1.12.16, y versión 1.13.x anterior a 1.13.12, como es usado en DBusServer en Canonst Upstart en Ubuntu versión 14.04 (y en algunos usos menos comunes de demonio dbus), permite suplantación de identidad de cookie debido al manejo inapropiado de enlaces simbólicos (symlink) en la implementación de referencia de DBUS_COOKIE_SHA1 en la biblioteca libdbus. (Esto solo afecta el mecanismo de autenticación DBUS_COOKIE_SHA1). • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00059.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00092.html http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00026.html http://www.openwall.com/lists/oss-security/2019/06/11/2 http://www.securityfocus.com/bid/108751 https://access.redhat.com/errata/RHSA-2019:1726 https://access.redhat.com/errata/RHSA-2019:2868 https://access.redhat.com/errata/RHSA-2019:2870 https://access.red • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-287: Improper Authentication •
CVSS: 1.9EPSS: 0%CPEs: 50EXPL: 0CVE-2015-0245
https://notcve.org/view.php?id=CVE-2015-0245
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds. D-Bus 1.4.x hasta 1.6.x anterior a 1.6.30, 1.8.x anterior a 1.8.16, y 1.9.x anterior a 1.9.10 no valida la fuente de los señales ActivationFailure, lo que permite a usuarios locales causar una denegación de servicio (retorno del error del fallo de activación) mediante el aprovechamiento de una condición de carrera que involucra el envío de un señal ActivationFailure antes de que systemd responda. • http://advisories.mageia.org/MGASA-2015-0071.html http://lists.opensuse.org/opensuse-updates/2015-02/msg00066.html http://www.debian.org/security/2015/dsa-3161 http://www.mandriva.com/security/advisories?name=MDVSA-2015:176 http://www.openwall.com/lists/oss-security/2015/02/09/6 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 2.1EPSS: 0%CPEs: 26EXPL: 2CVE-2014-7824
https://notcve.org/view.php?id=CVE-2014-7824
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1. D-Bus hasta 1.3.0 y 1.6.x antes de 1.6.26, 1.8.x antes de 1.8.10, y 1.9.x antes de 1.9.2 permite a usuarios locales provocar una denegación de servicio (la prevención de nuevas conexiones y caída de conexión) colocando en cola el número máximo de descriptores de archivos. NOTA: esta vulnerabilidad existe debido a que no se completo la solución para CVE-2014 a 3.636,1. • http://advisories.mageia.org/MGASA-2014-0457.html http://secunia.com/advisories/62603 http://www.debian.org/security/2014/dsa-3099 http://www.mandriva.com/security/advisories?name=MDVSA-2015:176 http://www.openwall.com/lists/oss-security/2014/11/10/2 http://www.securityfocus.com/bid/71012 http://www.ubuntu.com/usn/USN-2425-1 https://bugs.freedesktop.org/show_bug.cgi?id=85105 https://exchange.xforce.ibmcloud.com/vulnerabilities/98576 • CWE-399: Resource Management Errors •
CVSS: 4.4EPSS: 0%CPEs: 17EXPL: 0CVE-2014-3635
https://notcve.org/view.php?id=CVE-2014-3635
Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure. Error por un paso en D-Bus 1.3.0 hasta la versión 1.6.x en versiones anteriores a 1.6.24 y 1.8.x en versiones anteriores a 1.8.8, cuando cuando se ejecuta en sistemas de 64 bits y el límite max_message_unix_fds está establecido en un número impar, permite a usuarios locales provocar una denegación de servicio (caída de dbus-daemon) o posiblemente ejecutar código arbitrario enviando un descriptor de archivo superior al máximo, lo que desencadena un desbordamiento de buffer basado en memoria dinámica o un fallo de aserción. • http://advisories.mageia.org/MGASA-2014-0395.html http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html http://secunia.com/advisories/61378 http://www.debian.org/security/2014/dsa-3026 http://www.mandriva.com/security/advisories?name=MDVSA-2015:176 http://www.openwall.com/lists/oss-security/2014/09/16/9 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securitytracker.com/id/1030864 http://www.ubuntu.com/usn/USN-2352-1 https&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •