CVE-2009-1189
published 2009-04-27CVE-2009-1189: The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type…
PriorityP415low3.6CVSS 2.0
AVLACLAuNCNIPAP
EPSS
1.33%
68.1th percentile
The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.
Affected
51 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | dbus | < dbus 1.2.14-1 (bookworm) | dbus 1.2.14-1 (bookworm) |
| freedesktop | dbus | <= 1.2.3 | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
| freedesktop | dbus | — | — |
CVSS provenance
nvdv2.03.6LOWAV:L/AC:L/Au:N/C:N/I:P/A:P
osv2.1LOW
vendor_debian2.1HIGH
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
D-Bus vulnerability
vendor_ubuntu·2009-07-13
CVE-2009-1189 D-Bus vulnerability
Title: D-Bus vulnerability
Summary: D-Bus vulnerability
It was discovered that the D-Bus library did not correctly validate
signatures. If a local user sent a specially crafted D-Bus key, they could
spoof a valid signature and bypass security policies.
Instructions: After a standard system upgrade you need to reboot your computer to
effect the necessary changes.
Red Hat
dbus: invalid fix for CVE-2008-3834
vendor_redhat·2009-04-16·CVSS 2.1
CVE-2009-1189 [LOW] dbus: invalid fix for CVE-2008-3834
dbus: invalid fix for CVE-2008-3834
The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.
Debian
CVE-2009-1189: dbus - The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D...
vendor_debian·2009·CVSS 2.1
CVE-2009-1189 [LOW] CVE-2009-1189: dbus - The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D...
The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.
Scope: local
bookworm: resolved (fixed in 1.2.14-1)
bullseye: resolved (fixed in 1.2.14-1)
forky: resolved (fixed in 1.2.14-1)
sid: resolved (fixed in 1.2.14-1)
trixie: resolved (fixed in 1.2.14-1)
GHSA
GHSA-2332-hcww-wjmr: The _dbus_validate_signature_with_reason function (dbus-marshal-validate
ghsa_unreviewed·2022-05-02·CVSS 2.1
CVE-2009-1189 [LOW] CWE-20 GHSA-2332-hcww-wjmr: The _dbus_validate_signature_with_reason function (dbus-marshal-validate
The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.
OSV
CVE-2009-1189: The _dbus_validate_signature_with_reason function (dbus-marshal-validate
osv·2009-04-27·CVSS 2.1
CVE-2009-1189 [LOW] CVE-2009-1189: The _dbus_validate_signature_with_reason function (dbus-marshal-validate
The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2009-1193 dbus: invalid signatures verified as valid due to improper fix for CVE-2008-3834
bugzilla·2009-04-22·CVSS 2.1
CVE-2009-1193 [LOW] CVE-2009-1193 dbus: invalid signatures verified as valid due to improper fix for CVE-2008-3834
CVE-2009-1193 dbus: invalid signatures verified as valid due to improper fix for CVE-2008-3834
The patch used to correct CVE-2008-3834 caused a new issue in dbus where it would verify invalid signatures as valid. This flaw would only affect dbus 1.2.4
and higher, or any dbus packages that applied the original upstream patch to correct CVE-2008-3834.
Discussion:
(In reply to comment #3)
> (In reply to comment #2)
> > Access Complexity: High (no existing applications will act on an invalid
> > signature so this would need to be custom/unsupported app that is written
> > incorrectly)
>
> Not sure if this is reason for AC:H. When scoring, you need to assume worst
> case - i.e. if there is an application that does something with invalid
> signatures and assess difficulty of triggering mis-be
Bugzilla
CVE-2009-1189 dbus: invalid fix for CVE-2008-3834
bugzilla·2009-04-20·CVSS 2.1
CVE-2009-1189 [LOW] CVE-2009-1189 dbus: invalid fix for CVE-2008-3834
CVE-2009-1189 dbus: invalid fix for CVE-2008-3834
It was found that the patch to fix CVE-2008-3834 in dbus was incorrect and as a
result the flaw was never properly fixed (remote denial of service
vulnerability). This issue has been assigned CVE-2009-1189.
The upstream bug report is here:
https://bugs.freedesktop.org/show_bug.cgi?id=17803
Our bug report for CVE-2008-3834 is bug #464674 .
Discussion:
The upstream fix is here:
https://bugs.freedesktop.org/attachment.cgi?id=24436
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2010:0018 https://rhn.redhat.com/errata/RHSA-2010-0018.html
http://bugs.freedesktop.org/show_bug.cgi?id=17803http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705http://lists.vmware.com/pipermail/security-announce/2010/000082.htmlhttp://secunia.com/advisories/32127http://secunia.com/advisories/35810http://secunia.com/advisories/38794http://www.freedesktop.org/wiki/Software/dbus#head-dad0dab297a44f1d7a3b1259cfc06b583fd6a88ahttp://www.openwall.com/lists/oss-security/2009/04/16/13http://www.securityfocus.com/bid/31602http://www.vupen.com/english/advisories/2010/0528https://exchange.xforce.ibmcloud.com/vulnerabilities/50385https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10308https://rhn.redhat.com/errata/RHSA-2010-0095.htmlhttps://usn.ubuntu.com/799-1/http://bugs.freedesktop.org/show_bug.cgi?id=17803http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705http://lists.vmware.com/pipermail/security-announce/2010/000082.htmlhttp://secunia.com/advisories/32127http://secunia.com/advisories/35810http://secunia.com/advisories/38794http://www.freedesktop.org/wiki/Software/dbus#head-dad0dab297a44f1d7a3b1259cfc06b583fd6a88ahttp://www.openwall.com/lists/oss-security/2009/04/16/13http://www.securityfocus.com/bid/31602http://www.vupen.com/english/advisories/2010/0528https://exchange.xforce.ibmcloud.com/vulnerabilities/50385https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10308https://rhn.redhat.com/errata/RHSA-2010-0095.htmlhttps://usn.ubuntu.com/799-1/
2009-04-27
Published