RedHat Security Advisory RHSA-2009:0008

The remote host is missing updates announced in advisory RHSA-2009:0008. D-Bus is a system for sending messages between applications. It is used for the system-wide message bus service and as a per-user-login-session messaging facility. A denial-of-service flaw was discovered in the system for...

[SECURITY] [DSA 1690-1] New avahi packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1690-1 [email protected] http://www.debian.org/security/ Florian Weimer December 22, 2008 http://www.debian.org/security/faq -...

USN-696-1: Avahi vulnerabilities

Emanuele Aina discovered that Avahi did not properly validate its input when processing data over D-Bus. A local attacker could send an empty TXT message via D-Bus and cause a denial of service failed assertion. This issue only affected Ubuntu 6.06 LTS. CVE-2007-3372 Hugo Dias discovered that Ava...

CVE-2008-4311

The default configuration of system.conf in D-Bus aka DBus before 1.2.6 omits the sendtype attribute in certain rules, which allows local users to bypass intended access restrictions by 1 sending messages, related to sendrequestedreply; and possibly 2 receiving messages, related to...

Default configuration

The default configuration of system.conf in D-Bus aka DBus before 1.2.6 omits the sendtype attribute in certain rules, which allows local users to bypass intended access restrictions by 1 sending messages, related to sendrequestedreply; and possibly 2 receiving messages, related to...

CVE-2008-4311

The default configuration of system.conf in D-Bus aka DBus before 1.2.6 omits the sendtype attribute in certain rules, which allows local users to bypass intended access restrictions by 1 sending messages, related to sendrequestedreply; and possibly 2 receiving messages, related to...

CVE-2008-4311

The default configuration of system.conf in D-Bus aka DBus before 1.2.6 omits the sendtype attribute in certain rules, which allows local users to bypass intended access restrictions by 1 sending messages, related to sendrequestedreply; and possibly 2 receiving messages, related to...

CVE-2008-4311

The CVE-2008-4311 issue affects D‑Bus (dbus) before 1.2.6 where the default system.conf rule set omits the send_type attribute. This can allow local users to bypass access controls by manipulating send_requested_reply (and potentially receive_requested_reply), enabling unauthorized message sendin...

CVE-2008-4311

The default configuration of system.conf in D-Bus aka DBus before 1.2.6 omits the sendtype attribute in certain rules, which allows local users to bypass intended access restrictions by 1 sending messages, related to sendrequestedreply; and possibly 2 receiving messages, related to...

CVE-2008-4311

The default configuration of system.conf in D-Bus aka DBus before 1.2.6 omits the sendtype attribute in certain rules, which allows local users to bypass intended access restrictions by 1 sending messages, related to sendrequestedreply; and possibly 2 receiving messages, related to...

[SECURITY] Fedora 9 Update: dbus-1.2.6-1.fc9

D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility...

[SECURITY] Fedora 10 Update: dbus-1.2.6-1.fc10

D-BUS is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility...

USN-653-1: D-Bus vulnerabilities

Havoc Pennington discovered that the D-Bus daemon did not correctly validate certain security policies. If a local user sent a specially crafted D-Bus request, they could bypass security policies that had a "sendinterface" defined. CVE-2008-0595 It was discovered that the D-Bus library did not...

D-Bus dbus_signature_validate()类型签名拒绝服务漏洞

BUGTRAQ ID: 31602 CVECAN ID: CVE-2008-3834 D-BUS是一个设计目标为应用程序间通信的消息总线系统。 D-BUS的dbusvalidatesignaturewithreason函数没有正确地验证类型代码： if last == DBUSDICTENTRYBEGINCHAR && !dbustypeisbasic p result = DBUSINVALIDDICTKEYMUSTBEBASICTYPE; goto out; 如果使用D-Bus的应用受骗验证了特制的签名的话，就可能会终止。 D-Bus 1.2.1 D-Bus -----...

[SECURITY] Fedora 9 Update: dbus-1.2.4-1.fc9

D-BUS is a system for sending messages between applications. It is used both for the systemwide message bus service, and as a per-user-login-session messaging facility...

D-Bus 'dbus_signature_validate()'类型签名拒绝服务漏洞

BUGTRAQ ID: 31602 CVE ID：CVE-2008-3834 CNCVE ID：CNCVE-20083834 D-BUS是一款设计目标为应用程序间通信的消息总线系统。 D-BUS不正确处理包含在消息中的畸形签名，本地攻击者可以利用漏洞对使用此库的应用程序进行拒绝服务攻击。 当要求验证类型签名"aiii"时可导致函数dbussignaturevalidate出现错误。 根据文档，dbussignaturevalidate可以用于检查类型签名的合法性，因此正确的必须是对上面提到的类型签名确定为非法。 D-BUS Inter-Process Communication Syst...

CVE-2008-3834

The dbussignaturevalidate function in the D-bus library libdbus before 1.2.4 allows remote attackers to cause a denial of service application abort via a message containing a malformed signature, which triggers a failed assertion error...

CVE-2008-3834

The dbussignaturevalidate function in the D-bus library libdbus before 1.2.4 allows remote attackers to cause a denial of service application abort via a message containing a malformed signature, which triggers a failed assertion error...

DEBIAN-CVE-2008-3834

The dbussignaturevalidate function in the D-bus library libdbus before 1.2.4 allows remote attackers to cause a denial of service application abort via a message containing a malformed signature, which triggers a failed assertion error...

CVE-2008-3834

The dbussignaturevalidate function in the D-bus library libdbus before 1.2.4 allows remote attackers to cause a denial of service application abort via a message containing a malformed signature, which triggers a failed assertion error...