dbus - Security Update
Summary
DSA-2971-1: dbus - security update. Affects dbus versions < 1.6.8-1+deb7u3. Fixed in 1.6.8-1+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
dbus is an asynchronous inter-process communication system used in the Debian 7 ecosystem. It allows different processes to communicate with each other on the same machine or across different machines. dbus is a critical component for various system services and user applications.
Vulnerability Detail
The dbus package in Debian 7 is affected by multiple vulnerabilities:
-
CVE-2014-3477: dbus-daemon sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service. This flaw can be exploited by a local attacker to cause a bus-activated service to attempt to start and fail, denying other users access to the service.
-
CVE-2014-3532: dbus-daemon's support for file descriptor passing contains a bug that can be exploited by a malicious process to disconnect system services or user applications from the D-Bus system. This can lead to a denial of service.
-
CVE-2014-3533: A malicious process can force services to be disconnected from the D-Bus system by causing dbus-daemon to attempt to forward invalid file descriptors to a victim process. This can also result in a denial of service.
How To Fix
Minimum fixed version
1.6.8-1+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade dbusTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
Upgrading the dbus package to the recommended versions will address the identified vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com. Vulert (https://vulert.com) is a platform that provides real-time monitoring and alerts for open-source vulnerabilities, allowing you to check if your application is affected without requiring access to the code or installation.
See every vulnerability recorded for dbus →
FAQ
dbus is an asynchronous inter-process communication system used in Debian 7. It allows different processes to communicate with each other on the same machine or across different machines.
CVE-2014-3477 allows a local attacker to cause a bus-activated service to attempt to start and fail, denying other users access to the service.
CVE-2014-3532 can be exploited by a malicious process to disconnect system services or user applications from the D-Bus system, leading to a denial of service.
CVE-2014-3533 allows a malicious process to force services to be disconnected from the D-Bus system, resulting in a denial of service.
To fix these vulnerabilities, you need to upgrade the dbus package to the recommended versions for your Debian distribution.
Related vulnerabilities
Recent vulnerabilities recorded for dbus.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
