CVE-2008-0595

Published: Feb 29, 2008Modified: Apr 23, 2026

4.6

Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 3.9 / Impact: 6.4

Source: NVD

Description

dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.

Affected (11)

Products: Fedoraproject: Fedora · Mandrakesoft: Mandrake Linux · Redhat: Enterprise Linux · +1 more

Show all products

Fedoraproject: Fedora · Mandrakesoft: Mandrake Linux · Redhat: Enterprise Linux · Freedesktop: Dbus

1 product

1 product

1 product

1 product

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 7
Mandrakesoft Mandrake Linux	Version 2007.0_x86_64
Mandrakesoft Mandrake Linux	Version 2007.1
Mandrakesoft Mandrake Linux	Version 2007.1
Mandrakesoft Mandrake Linux	Version 2007
Mandrakesoft Mandrake Linux	Version 2008.0
Mandrakesoft Mandrake Linux	Version 2008.0
Redhat Enterprise Linux	Version 5.0
Redhat Enterprise Linux	Version 5

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Freedesktop Dbus	Before 1.0.3
Freedesktop Dbus	From 1.1.0 to 1.1.20

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (52)

http://lists.freedesktop.org/archives/dbus/2008-February/009401.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2012-10/msg00094.html

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/29148

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/29160

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/29171

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/29173

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/29281

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/29323

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/30869

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/32281

Source: secalert@redhat.com

Broken Link

http://securitytracker.com/id?1019512

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://wiki.rpath.com/Advisories:rPSA-2008-0099

Source: secalert@redhat.com

Third Party Advisory

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0099

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2008/dsa-1599

Source: secalert@redhat.com

Third Party Advisory

http://www.j5live.com/2008/02/27/announce-d-bus-1120-conisten-water-released/

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:054

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2008-0159.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/archive/1/489280/100/0/threaded

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/28023

Source: secalert@redhat.com

PatchThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/usn-653-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2008/0694

Source: secalert@redhat.com

Broken Link

https://issues.rpath.com/browse/RPL-2282

Source: secalert@redhat.com

Third Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9353

Source: secalert@redhat.com

Broken Link

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00893.html

Source: secalert@redhat.com

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00911.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.freedesktop.org/archives/dbus/2008-February/009401.html