1. Ubuntu Security Notices
  2. USN-653-1

USN-653-1: D-Bus vulnerabilities

Publication date

14 October 2008

Overview

D-Bus vulnerabilities

Releases

Packages

Details

Havoc Pennington discovered that the D-Bus daemon did not correctly
validate certain security policies. If a local user sent a specially
crafted D-Bus request, they could bypass security policies that had a
“send_interface” defined. (CVE-2008-0595)

It was discovered that the D-Bus library did not correctly validate
certain corrupted signatures. If a local user sent a specially crafted
D-Bus request, they could crash applications linked against the D-Bus
library, leading to a denial of service. (CVE-2008-3834)

Havoc Pennington discovered that the D-Bus daemon did not correctly
validate certain security policies. If a local user sent a specially
crafted D-Bus request, they could bypass security policies that had a
“send_interface” defined. (CVE-2008-0595)

It was discovered that the D-Bus library did not correctly validate
certain corrupted signatures. If a local user sent a specially crafted
D-Bus request, they could crash applications linked against the D-Bus
library, leading to a denial of service. (CVE-2008-3834)

Update instructions

After a standard system upgrade you need to reboot your computer to effect the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
8.04 hardy libdbus-1-3 –  1.1.20-1ubuntu3.1
7.10 gutsy libdbus-1-3 –  1.1.1-3ubuntu4.2
7.04 feisty libdbus-1-3 –  1.0.2-1ubuntu4.2
6.06 dapper libdbus-1-2 –  0.60-6ubuntu8.3

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›