Access Control Bypass

2020-04-1000:46:46

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0004 Low

EPSS

Percentile

10.1%

JSON

dbus-glib is vulnerable to access control bypass. It was discovered that dbus-glib did not enforce the “access” flag on exported GObject properties. If such a property were read/write internally but specified as read-only externally, a malicious, local user could use this flaw to modify that property of an application. Such a change could impact the application’s behavior (for example, if an IP address were changed the network may not come up properly after reboot) and possibly lead to a denial of service.

CPENameOperatorVersion
dbus-glibeq0.73__8.el5
networkmanagereq0.7.0__9.el5
networkmanagereq0.7.0__3.el5
networkmanagereq0.6.4__8.el5
networkmanagereq0.7.0__4.el5_3
networkmanagereq0.7.0__9.el5_4
networkmanagereq0.6.4__6.el5
dbus-glibeq0.73__8.el5
networkmanagereq0.7.0__9.el5
networkmanagereq0.7.0__3.el5

Name	Operator	Version
dbus-glib	eq	0.73__8.el5
networkmanager	eq	0.7.0__9.el5
networkmanager	eq	0.7.0__3.el5
networkmanager	eq	0.6.4__8.el5
networkmanager	eq	0.7.0__4.el5_3
networkmanager	eq	0.7.0__9.el5_4
networkmanager	eq	0.6.4__6.el5
dbus-glib	eq	0.73__8.el5
networkmanager	eq	0.7.0__9.el5
networkmanager	eq	0.7.0__3.el5