Simon McVittie reports :

The patch issued by the D-Bus maintainers for CVE-2014-3636 was based on incorrect reasoning, and does not fully prevent the attack described as 'CVE-2014-3636 part A', which is repeated below.
Preventing that attack requires raising the system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a higher value. CVE-2014-7824 has been allocated for this vulnerability.

Simon McVittie discovered that the fix for CVE-2014-3636 was incorrect, as it did not fully address the underlying denial-of-service vector. This update starts the D-Bus daemon as root initially, so that it can properly raise its file descriptor count.

In addition, this update reverts the auth_timeout change in the previous security update to its old value because the new value causes boot failures on some systems. See the README.Debian file for details how to harden the D-Bus daemon against malicious local users.

Update to 1.8.12 (#1168438)

  - Fixes CVE-2014-3635 (fd.o#83622)

    - Fixes CVE-2014-3636 (fd.o#82820)

    - Fixes CVE-2014-3637 (fd.o#80559)

    - Fixes CVE-2014-3638 (fd.o#81053)

    - Fixes CVE-2014-3639 (fd.o#80919)

    - Fixes CVE-2014-7824 (fd.o#85105)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.6.28

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to 1.8.12\\r\\n* Fixes various CVE's

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

dbus-1 was updated to version 1.6.26 to fix one security issue and several other issues.

This security issue was fixed :

  - Increase dbus-daemon's RLIMIT_NOFILE rlimit to 65536 to     stop an attacker from exhausting the system bus' file     descriptors (CVE-2014-7824).

dbus-1 was updated to version 1.8.12 to fix one security issue.

This security issue was fixed :

  - Increase dbus-daemons RLIMIT_NOFILE rlimit to 65536 to     stop an attacker from exhausting the file descriptors of     the system bus (CVE-2014-7824).

Note: This already includes the fix for the regression that was introduced by the first fix for CVE-2014-7824 in 1.8.10.

On fast systems where local users are considered particularly hostile, administrators can return to the 5 second timeout (or any other value in milliseconds) by saving this as /etc/dbus-1/system-local.conf:
<busconfig> <limit name='auth_timeout'>5000</limit> </busconfig>

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has dbus packages installed that are affected by multiple vulnerabilities:

  - Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows     local applications to remove match rules for other applications and cause a denial of service (lost     process messages). (CVE-2006-6107)

  - dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow     directives in the security policy only for fully qualified method calls, which allows local users to     bypass intended access restrictions via a method call with a NULL interface. (CVE-2008-0595)

  - The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before     1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature     via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834. (CVE-2009-1189)

  - libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other     products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS     environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications     that do not cleanse environment variables, not in libdbus itself: we do not support use of libdbus in     setuid binaries that do not sanitize their environment before their first call into libdbus.
    (CVE-2012-3524)

  - The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before     1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service     (service crash) via a crafted message. (CVE-2013-2168)

  - The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an     AccessDenied error to the service instead of a client when the client is prohibited from accessing the     service, which allows local users to cause a denial of service (initialization failure and exit) or     possibly conduct a side-channel attack via a D-Bus message to an inactive service. (CVE-2014-3477)

  - dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service     (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message     containing an invalid file descriptor. (CVE-2014-3533)

  - Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a     64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a     denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file     descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.
    (CVE-2014-3635)

  - D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of     service (prevention of new connections and connection drop) by queuing the maximum number of file     descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more     than the allowed number of file descriptors for a single sendmsg call. (CVE-2014-3636)

  - D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for     processes that have terminated, which allows local users to cause a denial of service via a D-bus message     containing a D-Bus connection file descriptor. (CVE-2014-3637)

  - The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8     allows local users to cause a denial of service (CPU consumption) via a large number of method calls.
    (CVE-2014-3638)

  - The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections,     which allows local users to cause a denial of service (incomplete connection consumption and prevention of     new connections) via a large number of incomplete connections. (CVE-2014-3639)

  - D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to     cause a denial of service (prevention of new connections and connection drop) by queuing the maximum     number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2014-3636.1. (CVE-2014-7824)

  - D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate     the source of ActivationFailure signals, which allows local users to cause a denial of service (activation     failure error returned) by leveraging a race condition involving sending an ActivationFailure signal     before systemd responds. (CVE-2015-0245)

  - An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-     daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local     attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use     this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus     clients. (CVE-2020-12049)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has dbus packages installed that are affected by multiple vulnerabilities:

  - dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical     Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of     symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only     affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own     home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to     read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a     cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent     client connection came from an attacker-chosen uid, allowing authentication bypass. (CVE-2019-12749)

  - libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other     products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS     environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications     that do not cleanse environment variables, not in libdbus itself: we do not support use of libdbus in     setuid binaries that do not sanitize their environment before their first call into libdbus.
    (CVE-2012-3524)

  - Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows     local applications to remove match rules for other applications and cause a denial of service (lost     process messages). (CVE-2006-6107)

  - dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow     directives in the security policy only for fully qualified method calls, which allows local users to     bypass intended access restrictions via a method call with a NULL interface. (CVE-2008-0595)

  - The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before     1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature     via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834. (CVE-2009-1189)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
79197	FreeBSD : dbus -- incomplete fix for CVE-2014-3636 part A (c1930f45-6982-11e4-80e1-bcaec565249c)	Nessus	FreeBSD Local Security Checks	2014/11/12	2021/1/6	low
79886	Debian DSA-3099-1 : dbus - security update	Nessus	Debian Local Security Checks	2014/12/15	2021/1/11	low
80060	Fedora 21 : dbus-1.8.12-1.fc21 (2014-16147)	Nessus	Fedora Local Security Checks	2014/12/17	2021/1/11	medium
80130	Fedora 19 : dbus-1.6.28-1.fc19 (2014-16227)	Nessus	Fedora Local Security Checks	2014/12/22	2021/1/11	medium
80323	Fedora 21 : mingw-dbus-1.8.12-1.fc21 (2014-17595)	Nessus	Fedora Local Security Checks	2015/1/2	2021/1/11	medium
79350	openSUSE Security Update : dbus-1 (openSUSE-SU-2014:1454-1)	Nessus	SuSE Local Security Checks	2014/11/20	2021/1/19	low
83655	SUSE SLED12 / SLES12 Security Update : dbus-1 (SUSE-SU-2014:1724-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	low
79924	Fedora 20 : dbus-1.6.28-1.fc20 (2014-16243)	Nessus	Fedora Local Security Checks	2014/12/15	2021/1/11	medium
80317	Fedora 20 : mingw-dbus-1.6.28-1.fc20 (2014-17570)	Nessus	Fedora Local Security Checks	2015/1/2	2021/1/11	medium
167488	NewStart CGSL MAIN 6.02 : dbus Multiple Vulnerabilities (NS-SA-2022-0093)	Nessus	NewStart CGSL Local Security Checks	2022/11/15	2022/11/16	medium
301215	NewStart CGSL MAIN 6.06 (SP) : dbus Multiple Vulnerabilities (NS-SA-2026-0004)	Nessus	NewStart CGSL Local Security Checks	2026/3/6	2026/3/9	high

偵測

搜尋 Plugin

low

low

medium

medium

medium

low

low

medium

medium

medium

high