CVE-2008-0595

2008-02-2919:44:00

CWE-863

[email protected]

web.nvd.nist.gov

security vulnerability

d-bus

access restrictions

method call

null interface

local users

nvd

cve-2008-0595

5.9 Medium

AI Score

Confidence

Low

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

12.1%

JSON

dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.

CPENameOperatorVersion
mandrakesoft:mandrake_linuxmandrakesoft mandrake linuxeq2007.1
mandrakesoft:mandrake_linuxmandrakesoft mandrake linuxeq2008.0
mandrakesoft:mandrake_linuxmandrakesoft mandrake linuxeq2007
redhat:enterprise_linuxredhat enterprise linuxeq5.0
mandrakesoft:mandrake_linuxmandrakesoft mandrake linuxeq2007.0_x86_64
redhat:enterprise_linuxredhat enterprise linuxeq5
fedoraproject:fedorafedoraproject fedoraeq7
freedesktop:dbusfreedesktop dbuslt1.1.20
freedesktop:dbusfreedesktop dbuslt1.0.3

CPE	Name	Operator	Version
mandrakesoft:mandrake_linux	mandrakesoft mandrake linux	eq	2007.1
mandrakesoft:mandrake_linux	mandrakesoft mandrake linux	eq	2008.0
mandrakesoft:mandrake_linux	mandrakesoft mandrake linux	eq	2007
redhat:enterprise_linux	redhat enterprise linux	eq	5.0
mandrakesoft:mandrake_linux	mandrakesoft mandrake linux	eq	2007.0_x86_64
redhat:enterprise_linux	redhat enterprise linux	eq	5
fedoraproject:fedora	fedoraproject fedora	eq	7
freedesktop:dbus	freedesktop dbus	lt	1.1.20
freedesktop:dbus	freedesktop dbus	lt	1.0.3