K17255 : D-Bus vulnerability CVE-2014-3477

Security Advisory Description

The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service. (CVE-2014-3477)

Impact

This vulnerability may allow a locally authenticated user to cause a denial-of-service (DoS) or possibly conduct a side-channel attack through a D-Bus message to an inactive service.

For Traffix SDC, the dbusdaemon is used for package dependency reasons. The impact of thedbusdaemon becoming unavailable is minimal. In addition, only administrative users are allowed on the Traffix SDC users, limiting the amount of potential attackers.