The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0335 advisory.

    D-Bus is a system for sending messages between applications. It is used both for the system-wide message     bus service, and as a per-user-login-session messaging facility.

    Security Fix(es):

    * dbus: dbus-daemon crashes when receiving message with incorrectly nested parentheses and curly brackets     (CVE-2022-42010)

    * dbus: dbus-daemon can be crashed by messages with array length inconsistent with element type     (CVE-2022-42011)

    * dbus: `_dbus_marshal_byteswap` doesn't process fds in messages with foreign endianness correctly     (CVE-2022-42012)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the dbus packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <=     1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the     same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap,     which is still used by data structures necessary for the other usernames sharing the UID, possibly leading     to a crash or other undefined behaviors (CVE-2020-35512)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of dbus installed on the remote host is prior to 1.6.12-14.31. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1730 advisory.

    An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

    An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

    An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-100 advisory.

    An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

    An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

    An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the dbus packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the dbus package has been released.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:0096 advisory.

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:0335 advisory.

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
170418	RHEL 9 : dbus (RHSA-2023:0335)	Nessus	Red Hat Local Security Checks	1/23/2023	11/7/2024	medium
177182	EulerOS Virtualization 3.0.6.0 : dbus (EulerOS-SA-2023-2208)	Nessus	Huawei Local Security Checks	6/13/2023	6/13/2023	high
174618	Amazon Linux AMI : dbus (ALAS-2023-1730)	Nessus	Amazon Linux Local Security Checks	4/21/2023	12/11/2024	medium
173065	Amazon Linux 2023 : dbus, dbus-common, dbus-daemon (ALAS2023-2023-100)	Nessus	Amazon Linux Local Security Checks	3/21/2023	12/11/2024	medium
172287	EulerOS 2.0 SP5 : dbus (EulerOS-SA-2023-1497)	Nessus	Huawei Local Security Checks	3/8/2023	8/31/2023	medium
171319	EulerOS 2.0 SP10 : dbus (EulerOS-SA-2023-1352)	Nessus	Huawei Local Security Checks	2/10/2023	9/4/2023	medium
203195	Photon OS 4.0: Dbus PHSA-2022-4.0-0263	Nessus	PhotonOS Local Security Checks	7/23/2024	7/23/2024	medium
184495	Rocky Linux 8 : dbus (RLSA-2023:0096)	Nessus	Rocky Linux Local Security Checks	11/6/2023	11/6/2023	medium
184914	Rocky Linux 9 : dbus (RLSA-2023:0335)	Nessus	Rocky Linux Local Security Checks	11/7/2023	11/7/2023	medium

Detections

Analytics

Plugins Search

medium

high

medium

medium

medium

medium

medium

medium

medium