Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service (lost process messages).

The remote NewStart CGSL host, running version MAIN 6.02, has dbus packages installed that are affected by multiple vulnerabilities:

  - Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows     local applications to remove match rules for other applications and cause a denial of service (lost     process messages). (CVE-2006-6107)

  - dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow     directives in the security policy only for fully qualified method calls, which allows local users to     bypass intended access restrictions via a method call with a NULL interface. (CVE-2008-0595)

  - The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before     1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature     via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834. (CVE-2009-1189)

  - libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other     products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS     environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications     that do not cleanse environment variables, not in libdbus itself: we do not support use of libdbus in     setuid binaries that do not sanitize their environment before their first call into libdbus.
    (CVE-2012-3524)

  - The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before     1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service     (service crash) via a crafted message. (CVE-2013-2168)

  - The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an     AccessDenied error to the service instead of a client when the client is prohibited from accessing the     service, which allows local users to cause a denial of service (initialization failure and exit) or     possibly conduct a side-channel attack via a D-Bus message to an inactive service. (CVE-2014-3477)

  - dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service     (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message     containing an invalid file descriptor. (CVE-2014-3533)

  - Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a     64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a     denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file     descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.
    (CVE-2014-3635)

  - D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of     service (prevention of new connections and connection drop) by queuing the maximum number of file     descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more     than the allowed number of file descriptors for a single sendmsg call. (CVE-2014-3636)

  - D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for     processes that have terminated, which allows local users to cause a denial of service via a D-bus message     containing a D-Bus connection file descriptor. (CVE-2014-3637)

  - The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8     allows local users to cause a denial of service (CPU consumption) via a large number of method calls.
    (CVE-2014-3638)

  - The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections,     which allows local users to cause a denial of service (incomplete connection consumption and prevention of     new connections) via a large number of incomplete connections. (CVE-2014-3639)

  - D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to     cause a denial of service (prevention of new connections and connection drop) by queuing the maximum     number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2014-3636.1. (CVE-2014-7824)

  - D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate     the source of ActivationFailure signals, which allows local users to cause a denial of service (activation     failure error returned) by leveraging a race condition involving sending an ActivationFailure signal     before systemd responds. (CVE-2015-0245)

  - An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-     daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local     attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use     this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus     clients. (CVE-2020-12049)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

6 vulnerabilities were discovered for the dbus-1 and dbus-1-x11 packages in openSUSE versions 11.4, 12.1, and 12.2.

From Red Hat Security Advisory 2007:0008 :

Updated dbus packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

D-BUS is a system for sending messages between applications. It is used both for the systemwide message bus service, and as a per-user-login-session messaging facility.

Kimmo Hamalainen discovered a flaw in the way D-BUS processes certain messages. It is possible for a local unprivileged D-BUS process to disrupt the ability of another D-BUS process to receive messages.
(CVE-2006-6107)

Users of dbus are advised to upgrade to these updated packages, which contain backported patches to correct this issue.

Kimmo Hamalainen discovered that local users could delete other users' D-Bus match rules. Applications would stop receiving D-Bus messages, resulting in a local denial of service, and potential data loss for applications that depended on D-Bus for storing information.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was discovered in D-Bus that could be exploited by a local attacker to cause a Denial of Service.

Updated packages have been patched to correct this issue.

Updated dbus packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

D-BUS is a system for sending messages between applications. It is used both for the systemwide message bus service, and as a per-user-login-session messaging facility.

Kimmo Hamalainen discovered a flaw in the way D-BUS processes certain messages. It is possible for a local unprivileged D-BUS process to disrupt the ability of another D-BUS process to receive messages.
(CVE-2006-6107)

Users of dbus are advised to upgrade to these updated packages, which contain backported patches to correct this issue.

Secunia reports :

D-Bus have a weakness, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

An error within the 'match_rule_equal()' function can be exploited to disable the ability of other processes to receive messages by removing their matches from D-Bus.

ID	Name	Product	Family	Severity
167488	NewStart CGSL MAIN 6.02 : dbus Multiple Vulnerabilities (NS-SA-2022-0093)	Nessus	NewStart CGSL Local Security Checks	medium
74795	openSUSE Security Update : dbus-1 / dbus-1-x11 (openSUSE-SU-2012:1418-1)	Nessus	SuSE Local Security Checks	medium
67436	Oracle Linux 4 : dbus (ELSA-2007-0008)	Nessus	Oracle Linux Local Security Checks	low
27989	Ubuntu 5.10 / 6.06 LTS / 6.10 : dbus vulnerability (USN-401-1)	Nessus	Ubuntu Local Security Checks	low
24616	Mandrake Linux Security Advisory : dbus (MDKSA-2006:233)	Nessus	Mandriva Local Security Checks	low
24314	RHEL 4 : dbus (RHSA-2007:0008)	Nessus	Red Hat Local Security Checks	low
24285	CentOS 4 : dbus (CESA-2007:0008)	Nessus	CentOS Local Security Checks	low
23871	FreeBSD : dbus -- match_rule_equal() Weakness (5b47b70d-8ba9-11db-81d5-00123ffe8333)	Nessus	FreeBSD Local Security Checks	low

Detections

Analytics

CVE-2006-6107

high

Tenable Plugins

medium

medium

low

low

low

low

low

low