Cookie Spoofing Vulnerability in dbus Package
Summary
ALPINE-CVE-2019-12749: dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink... Affects dbus versions < 1.12.16-r0. Fixed in 1.12.16-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dbus is an inter-process communication (IPC) system that allows communication between multiple processes running concurrently on the same machine. It is widely used in various Linux distributions, including Alpine, to facilitate communication between applications. The dbus package provides a message bus system that allows applications to communicate with one another, enabling features like service discovery and remote procedure calls. However, certain versions of dbus are vulnerable to a cookie spoofing issue that can lead to unauthorized access and authentication bypass.
Vulnerability Detail
The vulnerability, identified as CVE-2019-12749, affects dbus versions prior to 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12. It arises from a mishandling of symlinks in the DBUS_COOKIE_SHA1 authentication mechanism within the libdbus library. A malicious client with write access to its home directory can exploit this vulnerability by manipulating a ~/.dbus-keyrings symlink. This manipulation allows the malicious client to trick a DBusServer into reading and writing in unintended locations, potentially leading to the reuse of a known cookie and authentication bypass. The severity of this vulnerability is rated at CVSS 7.1, indicating a high risk of exploitation.
How To Fix
Minimum fixed version
1.12.16-r0
This is the first release that contains the fix.
sudo apk add --upgrade dbusTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict write access to their home directories or the ~/.dbus-keyrings file to prevent unauthorized manipulation. However, this is not a substitute for applying the necessary updates.
Conclusion
The dbus package has a significant vulnerability that can lead to cookie spoofing and authentication bypass. It is crucial for users to update their dbus installations to the patched versions to safeguard their systems against potential exploitation. Regular monitoring and updates are essential to maintain security.
See every vulnerability recorded for dbus →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
The affected versions include dbus versions prior to 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Exploitation of this vulnerability can lead to unauthorized access, authentication bypass, and potential data breaches.
Yes, the permanent fix is to update the dbus package to version 1.12.16-r0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for dbus.
