CVE Vulnerabilities

CVE-2008-4311

Published: Dec 10, 2008 | Modified: Aug 08, 2017
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
4.6 MEDIUM
AV:L/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

The default configuration of system.conf in D-Bus (aka DBus) before 1.2.6 omits the send_type attribute in certain rules, which allows local users to bypass intended access restrictions by (1) sending messages, related to send_requested_reply; and possibly (2) receiving messages, related to receive_requested_reply.

Affected Software

Name Vendor Start Version End Version
Dbus Freedesktop 0.13 0.13
Dbus Freedesktop 0.60 0.60
Dbus Freedesktop 1.1.2 1.1.2
Dbus Freedesktop 0.34 0.34
Dbus Freedesktop 0.92 0.92
Dbus Freedesktop 0.50 0.50
Dbus Freedesktop 0.35.1 0.35.1
Dbus Freedesktop 0.5 0.5
Dbus Freedesktop 0.36.1 0.36.1
Dbus Freedesktop 0.33 0.33
Dbus Freedesktop 1.0 1.0
Dbus Freedesktop 0.10 0.10
Dbus Freedesktop 1.0 1.0
Dbus Freedesktop 0.11 0.11
Dbus Freedesktop 1.1.0 1.1.0
Dbus Freedesktop 0.2 0.2
Dbus Freedesktop 0.9 0.9
Dbus Freedesktop 0.23.2 0.23.2
Dbus Freedesktop 0.35 0.35
Dbus Freedesktop 0.91 0.91
Dbus Freedesktop 0.6 0.6
Dbus Freedesktop 0.8 0.8
Dbus Freedesktop 0.36 0.36
Dbus Freedesktop 0.32 0.32
Dbus Freedesktop 1.0 1.0
Dbus Freedesktop 0.22 0.22
Dbus Freedesktop 1.1.1 1.1.1
Dbus Freedesktop 0.4 0.4
Dbus Freedesktop 0.61 0.61
Dbus Freedesktop 0.21 0.21
Dbus Freedesktop 0.35.2 0.35.2
Dbus Freedesktop * 1.2.4
Dbus Freedesktop 0.23.3 0.23.3
Dbus Freedesktop 0.20 0.20
Dbus Freedesktop 1.0 1.0
Dbus Freedesktop 0.7 0.7
Dbus Freedesktop 0.1 0.1
Dbus Freedesktop 0.62 0.62
Dbus Freedesktop 0.23.1 0.23.1
Dbus Freedesktop 0.3 0.3
Dbus Freedesktop 0.12 0.12
Dbus Freedesktop 0.90 0.90
Dbus Freedesktop 1.1.4 1.1.4
Dbus Freedesktop 0.36.2 0.36.2
Dbus Freedesktop 0.23 0.23
Dbus Freedesktop 0.31 0.31

References