CVE-2008-0595
Fixed in a distro release EPSS <1%
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
Products: fedoraproject fedora, mandrakesoft mandrake_linux, redhat enterprise_linux, freedesktop dbus
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | dbus | 1.1.20-1 |
| Debian 13 | dbus | 1.1.20-1 |
| Debian 14 | dbus | 1.1.20-1 |
| Debian 4.0 | dbus | 1.0.2-1+etch1 |
| Red Hat Enterprise Linux 5 | dbus | 0:1.0.0-6.3.el5_1 |
| Red Hat Enterprise Linux 5 | dbus-debuginfo | 0:1.0.0-6.3.el5_1 |
| Red Hat Enterprise Linux 5 | dbus-devel | 0:1.0.0-6.3.el5_1 |
| Red Hat Enterprise Linux 5 | dbus-x11 | 0:1.0.0-6.3.el5_1 |
| openSUSE Tumbleweed | dbus-1 | 1.12.20-5.5 |