NetSight
IP …
medium4.6

CVE-2008-0595

dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qual…

Impact

dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.

Affected products

VendorProductAffected versions
FedoraprojectFedora
Version 7
MandrakesoftMandrake Linux
Versions 2007, 2007.0_x86_64, 2007.1, 2008.0
RedhatEnterprise Linux
Versions 5, 5.0
FreedesktopDbus
before 1.0.3
from 1.1.0 before 1.1.20

Weakness classification

CWE-863

References