7.1 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
3.6 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:P/A:N
0.0005 Low
EPSS
Percentile
15.2%
Severity: High
Date : 2019-06-18
CVE-ID : CVE-2019-12749
Package : dbus
Type : access restriction bypass
Remote : No
Link : https://security.archlinux.org/AVG-974
The package dbus before version 1.12.16-1 is vulnerable to access
restriction bypass.
Upgrade to 1.12.16-1.
The problem has been fixed upstream in version 1.12.16.
None.
It has been discovered that dbus before 1.12.16 allows cookie spoofing
because of symlink mishandling in the reference implementation of
DBUS_COOKIE_SHA1 in the libdbus library. This issue only affects the
DBUS_COOKIE_SHA1 authentication mechanism.
A malicious client with write access to its own home directory could
manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a
different uid to read and write in unintended locations. In the worst
case, this could result in the DBusServer reusing a cookie that is
known to the malicious client, and treating that cookie as evidence
that a subsequent client connection came from an attacker-chosen uid,
allowing authentication bypass.
A local attacker could use this issue to bypass authentication and
escalate privileges.
https://www.openwall.com/lists/oss-security/2019/06/11/2
https://gitlab.freedesktop.org/dbus/dbus/issues/269
https://gitlab.freedesktop.org/dbus/dbus/commit/47b1a4c41004bf494b87370987b222c934b19016
https://security.archlinux.org/CVE-2019-12749
7.1 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
3.6 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:P/A:N
0.0005 Low
EPSS
Percentile
15.2%