Vulnerability Details CVE-2009-1189
The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 66.4%
CVSS Severity
CVSS v2 Score 3.6
References
- http://bugs.freedesktop.org/show_bug.cgi?id=17803
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://lists.vmware.com/pipermail/security-announce/2010/000082.html
- http://secunia.com/advisories/32127
- http://secunia.com/advisories/35810
- http://secunia.com/advisories/38794
- http://www.freedesktop.org/wiki/Software/dbus#head-dad0dab297a44f1d7a3b1259cfc06b583fd6a88a
- http://www.openwall.com/lists/oss-security/2009/04/16/13
- http://www.securityfocus.com/bid/31602
- http://www.vupen.com/english/advisories/2010/0528
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50385
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10308
- https://rhn.redhat.com/errata/RHSA-2010-0095.html
- https://usn.ubuntu.com/799-1/
- http://bugs.freedesktop.org/show_bug.cgi?id=17803
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://lists.vmware.com/pipermail/security-announce/2010/000082.html
- http://secunia.com/advisories/32127
- http://secunia.com/advisories/35810
- http://secunia.com/advisories/38794
- http://www.freedesktop.org/wiki/Software/dbus#head-dad0dab297a44f1d7a3b1259cfc06b583fd6a88a
- http://www.openwall.com/lists/oss-security/2009/04/16/13
- http://www.securityfocus.com/bid/31602
- http://www.vupen.com/english/advisories/2010/0528
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50385
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10308
- https://rhn.redhat.com/errata/RHSA-2010-0095.html
- https://usn.ubuntu.com/799-1/
Products affected by CVE-2009-1189
-
cpe:2.3:a:freedesktop:dbus:0.1
-
cpe:2.3:a:freedesktop:dbus:0.10
-
cpe:2.3:a:freedesktop:dbus:0.11
-
cpe:2.3:a:freedesktop:dbus:0.12
-
cpe:2.3:a:freedesktop:dbus:0.13
-
cpe:2.3:a:freedesktop:dbus:0.2
-
cpe:2.3:a:freedesktop:dbus:0.20
-
cpe:2.3:a:freedesktop:dbus:0.21
-
cpe:2.3:a:freedesktop:dbus:0.22
-
cpe:2.3:a:freedesktop:dbus:0.23
-
cpe:2.3:a:freedesktop:dbus:0.23.1
-
cpe:2.3:a:freedesktop:dbus:0.23.2
-
cpe:2.3:a:freedesktop:dbus:0.23.3
-
cpe:2.3:a:freedesktop:dbus:0.23.4
-
cpe:2.3:a:freedesktop:dbus:0.3
-
cpe:2.3:a:freedesktop:dbus:0.31
-
cpe:2.3:a:freedesktop:dbus:0.32
-
cpe:2.3:a:freedesktop:dbus:0.32.0
-
cpe:2.3:a:freedesktop:dbus:0.33
-
cpe:2.3:a:freedesktop:dbus:0.33.0
-
cpe:2.3:a:freedesktop:dbus:0.34
-
cpe:2.3:a:freedesktop:dbus:0.35
-
cpe:2.3:a:freedesktop:dbus:0.35.0
-
cpe:2.3:a:freedesktop:dbus:0.35.1
-
cpe:2.3:a:freedesktop:dbus:0.35.2
-
cpe:2.3:a:freedesktop:dbus:0.36
-
cpe:2.3:a:freedesktop:dbus:0.36.0
-
cpe:2.3:a:freedesktop:dbus:0.36.1
-
cpe:2.3:a:freedesktop:dbus:0.36.2
-
cpe:2.3:a:freedesktop:dbus:0.4
-
cpe:2.3:a:freedesktop:dbus:0.5
-
cpe:2.3:a:freedesktop:dbus:0.50
-
cpe:2.3:a:freedesktop:dbus:0.6
-
cpe:2.3:a:freedesktop:dbus:0.60
-
cpe:2.3:a:freedesktop:dbus:0.61
-
cpe:2.3:a:freedesktop:dbus:0.62
-
cpe:2.3:a:freedesktop:dbus:0.7
-
cpe:2.3:a:freedesktop:dbus:0.8
-
cpe:2.3:a:freedesktop:dbus:0.9
-
cpe:2.3:a:freedesktop:dbus:0.90
-
cpe:2.3:a:freedesktop:dbus:0.91
-
cpe:2.3:a:freedesktop:dbus:0.92
-
cpe:2.3:a:freedesktop:dbus:0.93
-
cpe:2.3:a:freedesktop:dbus:0.94
-
cpe:2.3:a:freedesktop:dbus:0.95
-
cpe:2.3:a:freedesktop:dbus:1.0
-
cpe:2.3:a:freedesktop:dbus:1.0.0
-
cpe:2.3:a:freedesktop:dbus:1.0.1
-
cpe:2.3:a:freedesktop:dbus:1.0.2
-
cpe:2.3:a:freedesktop:dbus:1.0.3
-
cpe:2.3:a:freedesktop:dbus:1.1.0
-
cpe:2.3:a:freedesktop:dbus:1.1.1
-
cpe:2.3:a:freedesktop:dbus:1.1.2
-
cpe:2.3:a:freedesktop:dbus:1.1.20
-
cpe:2.3:a:freedesktop:dbus:1.1.3
-
cpe:2.3:a:freedesktop:dbus:1.1.4
-
cpe:2.3:a:freedesktop:dbus:1.2.1
-
cpe:2.3:a:freedesktop:dbus:1.2.2
-
cpe:2.3:a:freedesktop:dbus:1.2.3