D-BUS (dbus) before 0.22 does not properly restrict access to a socket, if the socket address is known, which allows local users to listen or send arbitrary messages on another user's per-user session bus via that socket.

Updated dbus packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat Security Response Team.

D-BUS is a system for sending messages between applications. It is used both for the systemwide message bus service, and as a per-user-login-session messaging facility.

Dan Reed discovered that a user can send and listen to messages on another user's per-user session bus if they know the address of the socket. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0201 to this issue. In Red Hat Enterprise Linux 4, the per-user session bus is only used for printing notifications, therefore this issue would only allow a local user to examine or send additional print notification messages.

Users of dbus are advised to upgrade to these updated packages, which contain backported patches to correct this issue.

Besides providing the global system-wide communication bus, dbus also offers per-user 'session' buses which applications in an user's session can create and use to communicate with each other. Daniel Reed discovered that the default configuration of the session dbus allowed a local user to connect to another user's session bus if its address was known. The fixed packages restrict the default permissions to the user who owns the session dbus instance.

Please note that a standard Ubuntu installation does not use the session bus for anything, so this can only be exploited if you are using custom software which uses it.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dan Reed discovered a vulnerability in the D-BUS system for sending messages between applications. He found that a user can send and listen to messages on another user's per-user session bus if they knew the address of the socket.

The updated packages have been patched to correct this problem.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:102 advisory.

    D-BUS is a system for sending messages between applications. It is     used both for the systemwide message bus service, and as a     per-user-login-session messaging facility.

    Dan Reed discovered that a user can send and listen to messages on another     user's per-user session bus if they know the address of the socket. The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2005-0201 to this issue.  In Red Hat Enterprise Linux 4, the     per-user session bus is only used for printing notifications,  therefore     this issue would only allow a local user to examine or send additional     print notification messages.

    Users of dbus are advised to upgrade to these updated packages,     which contain backported patches to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
21919	CentOS 4 : dbus (CESA-2005:102)	Nessus	CentOS Local Security Checks	low
20537	Ubuntu 4.10 : dbus vulnerability (USN-144-1)	Nessus	Ubuntu Local Security Checks	low
18562	Mandrake Linux Security Advisory : dbus (MDKSA-2005:105)	Nessus	Mandriva Local Security Checks	low
18441	RHEL 4 : dbus security update. (Low) (RHSA-2005:102)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2005-0201

high

Tenable Plugins

low

low

low

medium