The dbus_signature_validate function in the D-bus library (libdbus) before 1.2.4 allows remote attackers to cause a denial of service (application abort) via a message containing a malformed signature, which triggers a failed assertion error.

6 vulnerabilities were discovered for the dbus-1 and dbus-1-x11 packages in openSUSE versions 11.4, 12.1, and 12.2.

From Red Hat Security Advisory 2010:0018 :

Updated dbus packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

D-Bus is a system for sending messages between applications. It is used for the system-wide message bus service and as a per-user-login-session messaging facility.

It was discovered that the Red Hat Security Advisory RHSA-2009:0008 did not correctly fix the denial of service flaw in the system for sending messages between applications. A local user could use this flaw to send a message with a malformed signature to the bus, causing the bus (and, consequently, any process using libdbus to receive messages) to abort. (CVE-2009-1189)

Note: Users running any application providing services over the system message bus are advised to test this update carefully before deploying it in production environments.

All users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all running instances of dbus-daemon and all running applications using the libdbus library must be restarted, or the system rebooted.

From Red Hat Security Advisory 2009:0008 :

Updated dbus packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

D-Bus is a system for sending messages between applications. It is used for the system-wide message bus service and as a per-user-login-session messaging facility.

A denial-of-service flaw was discovered in the system for sending messages between applications. A local user could send a message with a malformed signature to the bus causing the bus (and, consequently, any process using libdbus to receive messages) to abort.
(CVE-2008-3834)

All users are advised to upgrade to these updated dbus packages, which contain backported patch which resolve this issue. For the update to take effect, all running instances of dbus-daemon and all running applications using libdbus library must be restarted, or the system rebooted.

A denial-of-service flaw was discovered in the system for sending messages between applications. A local user could send a message with a malformed signature to the bus causing the bus (and, consequently, any process using libdbus to receive messages) to abort.
(CVE-2008-3834)

Local users could crash the D-Bus daemon by sending a specially crafted message (CVE-2010-4352). This update also properly fixes CVE-2008-3834 / CVE-2009-1189.

Updated dbus packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

D-Bus is a system for sending messages between applications. It is used for the system-wide message bus service and as a per-user-login-session messaging facility.

It was discovered that the Red Hat Security Advisory RHSA-2009:0008 did not correctly fix the denial of service flaw in the system for sending messages between applications. A local user could use this flaw to send a message with a malformed signature to the bus, causing the bus (and, consequently, any process using libdbus to receive messages) to abort. (CVE-2009-1189)

Note: Users running any application providing services over the system message bus are advised to test this update carefully before deploying it in production environments.

All users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all running instances of dbus-daemon and all running applications using the libdbus library must be restarted, or the system rebooted.

Updated dbus packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

D-Bus is a system for sending messages between applications. It is used for the system-wide message bus service and as a per-user-login-session messaging facility.

A denial-of-service flaw was discovered in the system for sending messages between applications. A local user could send a message with a malformed signature to the bus causing the bus (and, consequently, any process using libdbus to receive messages) to abort.
(CVE-2008-3834)

All users are advised to upgrade to these updated dbus packages, which contain backported patch which resolve this issue. For the update to take effect, all running instances of dbus-daemon and all running applications using libdbus library must be restarted, or the system rebooted.

This update fixes a denial of service bug in dbus. (CVE-2008-3834)

Havoc Pennington discovered that the D-Bus daemon did not correctly validate certain security policies. If a local user sent a specially crafted D-Bus request, they could bypass security policies that had a 'send_interface' defined. (CVE-2008-0595)

It was discovered that the D-Bus library did not correctly validate certain corrupted signatures. If a local user sent a specially crafted D-Bus request, they could crash applications linked against the D-Bus library, leading to a denial of service. (CVE-2008-3834).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The D-Bus library did not correctly validate certain corrupted signatures which could cause a crash of applications linked against the D-Bus library if a local user were to send a specially crafted D-Bus request (CVE-2008-3834).

The updated packages have been patched to prevent this issue.

The remote host is affected by the vulnerability described in GLSA-200901-04 (D-Bus: Denial of Service)

    schelte reported that the dbus_signature_validate() function can     trigger a failed assertion when processing a message containing a     malformed signature.
  Impact :

    A local user could send a specially crafted message to the D-Bus     daemon, leading to a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Colin Walters discovered that the dbus_signature_validate function in dbus, a simple interprocess messaging system, is prone to a denial of service attack.

Freedesktop bug #15588 Avoiding using noreplace for /etc/dbus-1/*.conf files - they're not really configuration files.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
74795	openSUSE Security Update : dbus-1 / dbus-1-x11 (openSUSE-SU-2012:1418-1)	Nessus	SuSE Local Security Checks	medium
67981	Oracle Linux 5 : dbus (ELSA-2010-0018)	Nessus	Oracle Linux Local Security Checks	low
67785	Oracle Linux 5 : dbus (ELSA-2009-0008)	Nessus	Oracle Linux Local Security Checks	low
60510	Scientific Linux Security Update : dbus on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	low
57177	SuSE 10 Security Update : dbus (ZYPP Patch Number 7482)	Nessus	SuSE Local Security Checks	low
53590	SuSE 10 Security Update : dbus (ZYPP Patch Number 7483)	Nessus	SuSE Local Security Checks	low
53587	SuSE 11.1 Security Update : dbus (SAT Patch Number 4434)	Nessus	SuSE Local Security Checks	low
43819	RHEL 5 : dbus (RHSA-2010:0018)	Nessus	Red Hat Local Security Checks	low
43817	CentOS 5 : dbus (CESA-2010:0018)	Nessus	CentOS Local Security Checks	low
43724	CentOS 5 : dbus (CESA-2009:0008)	Nessus	CentOS Local Security Checks	low
39947	openSUSE Security Update : dbus-1 (dbus-1-246)	Nessus	SuSE Local Security Checks	low
36805	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : dbus vulnerabilities (USN-653-1)	Nessus	Ubuntu Local Security Checks	medium
36288	Mandriva Linux Security Advisory : dbus (MDVSA-2008:213)	Nessus	Mandriva Local Security Checks	low
35348	GLSA-200901-04 : D-Bus: Denial of Service	Nessus	Gentoo Local Security Checks	low
35317	RHEL 5 : dbus (RHSA-2009:0008)	Nessus	Red Hat Local Security Checks	low
35034	SuSE 10 Security Update : dbus (ZYPP Patch Number 5701)	Nessus	SuSE Local Security Checks	low
34478	Debian DSA-1658-1 : dbus - programming error	Nessus	Debian Local Security Checks	low
34437	openSUSE 10 Security Update : dbus-1 (dbus-1-5683)	Nessus	SuSE Local Security Checks	low
34381	Fedora 9 : dbus-1.2.4-1.fc9 (2008-8764)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2008-3834

critical

Tenable Plugins

medium

low

low

low

low

low

low

low

low

low

low

medium

low

low

low

low

low

low

low