dbus - Security Update
Summary
DSA-3099-1: dbus - security update. Affects dbus versions < 1.6.8-1+deb7u5. Fixed in 1.6.8-1+deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dbus is a message bus system that allows communication between different software applications. It is commonly used in Linux-based operating systems. The dbus package in Debian 7 (wheezy) and other distributions is vulnerable to a denial-of-service attack, which was not fully addressed in a previous fix. This vulnerability can be exploited by malicious local users to cause a system crash or disrupt the normal operation of the D-Bus daemon.
Vulnerability Detail
The vulnerability, identified as CVE-2014-3636, stems from an incorrect fix that did not fully mitigate the underlying denial-of-service vector. The D-Bus daemon in the affected versions of dbus is not properly raising its file descriptor count, leading to a potential resource exhaustion issue. This can be exploited by an attacker with local access to the system to cause a denial-of-service condition, impacting the availability of the D-Bus service and potentially affecting other system components that rely on it.
How To Fix
Minimum fixed version
1.6.8-1+deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade dbusTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to harden the D-Bus daemon against malicious local users. Details on how to implement this workaround can be found in the README.Debian file provided with the dbus package.
Conclusion
The dbus package in Debian 7 (wheezy) and other distributions is vulnerable to a denial-of-service attack. It is crucial to upgrade the dbus package to the recommended versions to mitigate this vulnerability. Additionally, implementing the provided workaround can further enhance the security of the D-Bus daemon. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dbus →
FAQ
D-Bus is a message bus system that enables communication between different software applications in Linux-based operating systems.
The vulnerability allows malicious local users to cause a denial-of-service condition, potentially impacting the availability of the D-Bus service and other system components that rely on it.
The vulnerability affects dbus version 1.6.8-1+deb7u5 in Debian 7 (wheezy) and version 1.8.10-1 in upcoming stable distributions (jessie) and unstable distributions (sid).
To fix this vulnerability, upgrade the dbus package to the recommended versions for your distribution. Instructions can be found in the 'how_to_fix' section of this report.
Yes, a workaround is available to harden the D-Bus daemon against malicious local users. Refer to the 'workaround' section of this report for more details.
Related vulnerabilities
Recent vulnerabilities recorded for dbus.
