Improper Use Of Flawed Policy

openstack-selinux is using flawed policy. policy flaw allows dbus messaging...

openstack-selinux: policy flaw allows dbus messaging

An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege escalation. A non-root attacker in one or more Red Hat OpenStack RHOSP containers could send messages to the dbus. With access to the dbus, t...

PackageKit < 1.1.13 - File Existence Disclosure

Exploit Title: File Existence Disclosure in PackageKit " sys.exit0 FILETOCHECK = sys.argv1 bus = dbus.SystemBus aptdbusobject = bus.getobject"org.freedesktop.PackageKit", "/org/freedesktop/PackageKit" aptdbusinterface = dbus.Interfaceaptdbusobject, "org.freedesktop.PackageKit" trans =...

aptdaemon File Existence Disclosure

Exploit Title: File Existence Disclosure in aptdaemon " sys.exit0 FILETOCHECK = sys.argv1 bus = dbus.SystemBus aptdbusobject = bus.getobject"org.debian.apt", "/org/debian/apt" aptdbusi...

DEBIAN-CVE-2020-15238

Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injection vulnerability. The impact highly depends on the system configuration. If Polkit-1 is disabled and for versions lower than 2.0.6, any...

CVE-2020-27187

An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcoreexternalcommand helper contains a logic flaw in which the service invoking D-Bus is not properly checked. An attacker on the local machine can replace /etc/fstab, and execute mount and other partitioning related...

Scientific Linux Security Update : dbus on SL7.x x86_64 (20201001)

Security Fixes : - dbus: DBusServer DBUSCOOKIESHA1 authentication bypass CVE-2019-12749 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141677; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

CentOS 7 : dbus (RHSA-2020:4032)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4032 advisory. - dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 and in some, less common, us...

[ASA-202010-8] kpmcore: privilege escalation

Arch Linux Security Advisory ASA-202010-8 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-27187 Package : kpmcore Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1253 Summary ======= The package kpmcore before version...

Security Bulletin: IBM Security Guardium is affected by a dbus vulnerability

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2019-12749 DESCRIPTION: dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 and in some, less common, uses of...

Oracle Linux 7 : glib2 / and / ibus (ELSA-2020-3978)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3978 advisory. - Backport patch to limit access to files when copying CVE-2019-12450 Resolves: 1722099 Tenable has extracted the preceding description block directly...

Oracle Linux 7 : dbus (ELSA-2020-4032)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4032 advisory. 1:1.10.24-15.0.1 - fix netlink poll: error 4 Zhenzhong Duan 1:1.10.24-15 - Fix CVE-2020-12049 1851992 Tenable has extracted the preceding description block...

dbus security update

1:1.10.24-15.0.1 - fix netlink poll: error 4 Zhenzhong Duan 1:1.10.24-15 - Fix CVE-2020-12049 1851992...

Huawei EulerOS: Security Advisory for dbus (EulerOS-SA-2020-2096)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP3 : dbus (EulerOS-SA-2020-2096)

According to the version of the dbus packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in dbus = 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message...

dbus before 1.10.28 1.12.x before 1.12.16 and 1.13.x before 1.13.12 as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some less common uses of dbus-daemon) allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case this could result in the DBusServer reusing a cookie that is known to the malicious client and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid allowing authentication bypass.

...

Huawei EulerOS: Security Advisory for dbus (EulerOS-SA-2020-1982)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for dbus (EulerOS-SA-2020-1903)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : ibus (EulerOS-SA-2020-1855)

According to the version of the ibus packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was discovered in ibus that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a...

EulerOS Virtualization for ARM 64 3.0.6.0 : dbus (EulerOS-SA-2020-1903)

According to the version of the dbus packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - An issue was discovered in dbus = 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file...