CVE-2008-0595 – dbus security policy circumvention

https://notcve.org/view.php?id=CVE-2008-0595

dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface. dbus-daemon en D-Bus anterior a 1.0.3 y 1.1.x anterior a 1.1.20, reconoce atributos de send_interface en directivas de permiso en la política de seguridad sólo para llamadas a métodos completamente cualificados, esto permite a usuarios locales evitar las restricciones de acceso pretendidas mediante llamadas a métodos con una interfaz NULL. • http://lists.freedesktop.org/archives/dbus/2008-February/009401.html http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html http://lists.opensuse.org/opensuse-updates/2012-10/msg00094.html http://secunia.com/advisories/29148 http://secunia.com/advisories/29160 http://secunia.com/advisories/29171 http://secunia.com/advisories/29173 http://secunia.com/advisories/29281 http://secunia.com/advisories/29323 http://secunia.com/advisories/30869 http://secunia.com/advisorie • CWE-863: Incorrect Authorization •