D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.

The remote NewStart CGSL host, running version MAIN 6.02, has dbus packages installed that are affected by multiple vulnerabilities:

  - Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows     local applications to remove match rules for other applications and cause a denial of service (lost     process messages). (CVE-2006-6107)

  - dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow     directives in the security policy only for fully qualified method calls, which allows local users to     bypass intended access restrictions via a method call with a NULL interface. (CVE-2008-0595)

  - The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before     1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature     via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834. (CVE-2009-1189)

  - libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other     products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS     environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications     that do not cleanse environment variables, not in libdbus itself: we do not support use of libdbus in     setuid binaries that do not sanitize their environment before their first call into libdbus.
    (CVE-2012-3524)

  - The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before     1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service     (service crash) via a crafted message. (CVE-2013-2168)

  - The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an     AccessDenied error to the service instead of a client when the client is prohibited from accessing the     service, which allows local users to cause a denial of service (initialization failure and exit) or     possibly conduct a side-channel attack via a D-Bus message to an inactive service. (CVE-2014-3477)

  - dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service     (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message     containing an invalid file descriptor. (CVE-2014-3533)

  - Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a     64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a     denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file     descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.
    (CVE-2014-3635)

  - D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of     service (prevention of new connections and connection drop) by queuing the maximum number of file     descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more     than the allowed number of file descriptors for a single sendmsg call. (CVE-2014-3636)

  - D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for     processes that have terminated, which allows local users to cause a denial of service via a D-bus message     containing a D-Bus connection file descriptor. (CVE-2014-3637)

  - The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8     allows local users to cause a denial of service (CPU consumption) via a large number of method calls.
    (CVE-2014-3638)

  - The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections,     which allows local users to cause a denial of service (incomplete connection consumption and prevention of     new connections) via a large number of incomplete connections. (CVE-2014-3639)

  - D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to     cause a denial of service (prevention of new connections and connection drop) by queuing the maximum     number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2014-3636.1. (CVE-2014-7824)

  - D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate     the source of ActivationFailure signals, which allows local users to cause a denial of service (activation     failure error returned) by leveraging a race condition involving sending an ActivationFailure signal     before systemd responds. (CVE-2015-0245)

  - An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-     daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local     attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use     this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus     clients. (CVE-2020-12049)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the dbus package has been released.

According to the versions of the dbus packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - D-BUS is a system for sending messages between     applications. It is used both for the system-wide     message bus service, and as a per-user-login-session     messaging facility.

  - Security Fix(es)

  - dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when     running on Linux 2.6.37-rc4 or later, allows local     users to cause a denial of service (system-bus     disconnect of other services or applications) by     sending a message containing a file descriptor, then     exceeding the maximum recursion depth before the     initial message is forwarded.(CVE-2014-3532)

  - dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows     local users to cause a denial of service (disconnect)     via a certain sequence of crafted messages that cause     the dbus-daemon to forward a message containing an     invalid file descriptor.(CVE-2014-3533)

  - D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before     1.8.16, and 1.9.x before 1.9.10 does not validate the     source of ActivationFailure signals, which allows local     users to cause a denial of service (activation failure     error returned) by leveraging a race condition     involving sending an ActivationFailure signal before     systemd responds.(CVE-2015-0245)

  - D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x     before 1.8.8 allows local users to (1) cause a denial     of service (prevention of new connections and     connection drop) by queuing the maximum number of file     descriptors or (2) cause a denial of service     (disconnect) via multiple messages that combine to have     more than the allowed number of file descriptors for a     single sendmsg call.(CVE-2014-3636)

  - The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x     before 1.6.20, and 1.8.x before 1.8.4, sends an     AccessDenied error to the service instead of a client     when the client is prohibited from accessing the     service, which allows local users to cause a denial of     service (initialization failure and exit) or possibly     conduct a side-channel attack via a D-Bus message to an     inactive service.(CVE-2014-3477)

  - D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x     before 1.8.8 does not properly close connections for     processes that have terminated, which allows local     users to cause a denial of service via a D-bus message     containing a D-Bus connection file     descriptor.(CVE-2014-3637)

  - Off-by-one error in D-Bus 1.3.0 through 1.6.x before     1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit     system and the max_message_unix_fds limit is set to an     odd number, allows local users to cause a denial of     service (dbus-daemon crash) or possibly execute     arbitrary code by sending one more file descriptor than     the limit, which triggers a heap-based buffer overflow     or an assertion failure.(CVE-2014-3635)

  - The bus_connections_check_reply function in     config-parser.c in D-Bus before 1.6.24 and 1.8.x before     1.8.8 allows local users to cause a denial of service     (CPU consumption) via a large number of method     calls.(CVE-2014-3638)

  - The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before     1.8.8 does not properly close old connections, which     allows local users to cause a denial of service     (incomplete connection consumption and prevention of     new connections) via a large number of incomplete     connections.(CVE-2014-3639)

  - D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before     1.8.10, and 1.9.x before 1.9.2 allows local users to     cause a denial of service (prevention of new     connections and connection drop) by queuing the maximum     number of file descriptors. NOTE: this vulnerability     exists because of an incomplete fix for     CVE-2014-3636.1.(CVE-2014-7824)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dbus-1 to version 1.8.22 fixes several issues.

This security issue was fixed :

  - boo#1003898: Do not treat ActivationFailure message     received from root-owned systemd name as a format     string.

    These non-security issues were fixed :

  - boo#978477: Correctly reset timeouts for pending file     descriptors

  - boo#980928: increase listen() backlog of AF_UNIX sockets     to SOMAXCONN

  - Change the default configuration for the session bus to     only allow EXTERNAL authentication (secure     kernel-mediated credentials-passing), as was already     done for the system bus.

  - Fix a memory leak when GetConnectionCredentials()     succeeds (fdo#91008)

  - Ensure that dbus-monitor does not reply to messages     intended for others (fdo#90952)

  - Add locking to DBusCounter's reference count and notify     function (fdo#89297)

  - Ensure that DBusTransport's reference count is protected     by the corresponding DBusConnection's lock (fdo#90312)

  - Correctly release DBusServer mutex before early-return     if we run out of memory while copying authentication     mechanisms (fdo#90021)

  - Correctly initialize all fields of DBusTypeReader     (fdo#90021)

  - Fix some missing \n in verbose (debug log) messages     (fdo#90004)

  - Clean up some memory leaks in test code (fdo#90021)

It was discovered that DBus incorrectly validated the source of ActivationFailure signals. A local attacker could use this issue to cause a denial of service. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-0245)

It was discovered that DBus incorrectly handled certain format strings. A local attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. This issue is only exposed to unprivileged users when the fix for CVE-2015-0245 is not applied, hence this issue is only likely to affect Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Ubuntu 16.04 LTS and Ubuntu 16.10 have been updated as a preventative measure in the event that a new attack vector for this issue is discovered. (No CVE number).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

dbus-1 was updated to version 1.8.16 to fix one security issue.

This update fixes the following security issue :

  - CVE-2015-0245: Do not allow non-uid-0 processes to send     forged ActivationFailure messages. On Linux systems with     systemd activation, this would allow a local denial of     service (bnc#916343).

These additional security hardenings are included :

  - Do not allow calls to UpdateActivationEnvironment from     uids other than the uid of the dbus-daemon. If a system     service installs unsafe security policy rules that allow     arbitrary method calls (such as CVE-2014-8148) then this     prevents memory consumption and possible privilege     escalation via UpdateActivationEnvironment.

  - Do not allow calls to UpdateActivationEnvironment or the     Stats interface on object paths other than     /org/freedesktop/DBus. Some system services install     unsafe security policy rules that allow arbitrary method     calls to any destination, method and interface with a     specified object path.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated dbus packages fix multiple vulnerabilities :

A denial of service vulnerability in D-Bus before 1.6.20 allows a local attacker to cause a bus-activated service that is not currently running to attempt to start, and fail, denying other users access to this service Additionally, in highly unusual environments the same flaw could lead to a side channel between processes that should not be able to communicate (CVE-2014-3477).

A flaw was reported in D-Bus's file descriptor passing feature. A local attacker could use this flaw to cause a service or application to disconnect from the bus, typically resulting in that service or application exiting (CVE-2014-3532).

A flaw was reported in D-Bus's file descriptor passing feature. A local attacker could use this flaw to cause an invalid file descriptor to be forwarded to a service or application, causing it to disconnect from the bus, typically resulting in that service or application exiting (CVE-2014-3533).

On 64-bit platforms, file descriptor passing could be abused by local users to cause heap corruption in dbus-daemon, leading to a crash, or potentially to arbitrary code execution (CVE-2014-3635).

A denial-of-service vulnerability in dbus-daemon allowed local attackers to prevent new connections to dbus-daemon, or disconnect existing clients, by exhausting descriptor limits (CVE-2014-3636).

Malicious local users could create D-Bus connections to dbus-daemon which could not be terminated by killing the participating processes, resulting in a denial-of-service vulnerability (CVE-2014-3637).

dbus-daemon suffered from a denial-of-service vulnerability in the code which tracks which messages expect a reply, allowing local attackers to reduce the performance of dbus-daemon (CVE-2014-3638).

dbus-daemon did not properly reject malicious connections from local users, resulting in a denial-of-service vulnerability (CVE-2014-3639).

The patch issued by the D-Bus maintainers for CVE-2014-3636 was based on incorrect reasoning, and does not fully prevent the attack described as CVE-2014-3636 part A, which is repeated below. Preventing that attack requires raising the system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a higher value.

By queuing up the maximum allowed number of fds, a malicious sender could reach the system dbus-daemon's RLIMIT_NOFILE (ulimit -n, typically 1024 on Linux). This would act as a denial of service in two ways :

  - new clients would be unable to connect to the     dbus-daemon

  - when receiving a subsequent message from a non-malicious     client that contained a fd, dbus-daemon would receive     the MSG_CTRUNC flag, indicating that the list of fds was     truncated; kernel fd-passing APIs do not provide any way     to recover from that, so dbus-daemon responds to     MSG_CTRUNC by disconnecting the sender, causing denial     of service to that sender.

This update resolves the issue (CVE-2014-7824).

non-systemd processes can make dbus-daemon think systemd failed to activate a system service, resulting in an error reply back to the requester, causing a local denial of service (CVE-2015-0245).

The remote host is affected by the vulnerability described in GLSA-201503-02 (D-Bus: Denial of Service)

    D-Bus doesn&rsquo;t validate the source of ActivationFailure signals.
  Impact :

    A local attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

dbus-1, dbus-1-x11 were updated to version 1.8.16 to fix one security issue.

This update fixes the following security issue :

  - CVE-2015-0245: Do not allow non-uid-0 processes to send     forged ActivationFailure messages. On Linux systems with     systemd activation, this would allow a local denial of     service (bnc#916343).

These additional security hardenings are included :

  - Do not allow calls to UpdateActivationEnvironment from     uids other than the uid of the dbus-daemon. If a system     service installs unsafe security policy rules that allow     arbitrary method calls (such as CVE-2014-8148) then this     prevents memory consumption and possible privilege     escalation via UpdateActivationEnvironment.

  - Do not allow calls to UpdateActivationEnvironment or the     Stats interface on object paths other than     /org/freedesktop/DBus. Some system services install     unsafe security policy rules that allow arbitrary method     calls to any destination, method and interface with a     specified object path.

Simon McVittie discovered a local denial of service flaw in dbus, an asynchronous inter-process communication system. On systems with systemd-style service activation, dbus-daemon does not prevent forged ActivationFailure messages from non-root processes. A malicious local user could use this flaw to trick dbus-daemon into thinking that systemd failed to activate a system service, resulting in an error reply back to the requester.

ID	Name	Product	Family	Severity
167488	NewStart CGSL MAIN 6.02 : dbus Multiple Vulnerabilities (NS-SA-2022-0093)	Nessus	NewStart CGSL Local Security Checks	medium
128758	Photon OS 1.0: Dbus PHSA-2019-1.0-0249	Nessus	PhotonOS Local Security Checks	low
99800	EulerOS 2.0 SP1 : dbus (EulerOS-SA-2016-1037)	Nessus	Huawei Local Security Checks	medium
94600	openSUSE Security Update : dbus-1 (openSUSE-2016-1269)	Nessus	SuSE Local Security Checks	low
94465	Ubuntu 14.04 LTS / 16.04 LTS : DBus vulnerabilities (USN-3116-1)	Nessus	Ubuntu Local Security Checks	medium
83693	SUSE SLED12 / SLES12 Security Update : dbus-1 (SUSE-SU-2015:0457-1)	Nessus	SuSE Local Security Checks	high
82451	Mandriva Linux Security Advisory : dbus (MDVSA-2015:176)	Nessus	Mandriva Local Security Checks	medium
81687	GLSA-201503-02 : D-Bus: Denial of Service	Nessus	Gentoo Local Security Checks	low
81397	openSUSE Security Update : dbus-1 / dbus-1-x11 (openSUSE-2015-150)	Nessus	SuSE Local Security Checks	high
81302	Debian DSA-3161-1 : dbus - security update	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2015-0245

medium

Tenable Plugins

medium

low

medium

low

medium

high

medium

low

high

low