Main Vulnerability Database Vulnerabilities #VU6932

Security restrictions bypass in D-Bus - #VU6932

Published: June 6, 2017 / Updated: June 9, 2017

Vulnerability identifier: #VU6932

CSH Severity: Low

CVSS v4: []

CVE-ID: N/A

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

Multiple vulnerabilities in D-Bus might allow an attacker to overwrite files with a fixed filename in arbitrary directories or conduct a symlink attack.

An attacker could possibly overwrite arbitrary files named “once” with content not controlled by the attacker.

A local attacker could perform a symlink attack against D-Bus’ test suite.

Affected software

D-Bus
Gentoo Linux

Remediation

Update to version 1.10.18.

External References

http://www.openwall.com/lists/oss-security/2017/02/16/4

Related Security Bulletins