Vulnerability Name:

CVE-2009-1189 (CCN-50385)

Assigned:2009-04-16
Published:2009-04-16
Updated:2023-02-13
Summary:The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key.
Note: this is due to an incorrect fix for CVE-2008-3834.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:3.6 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:P)
2.9 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:P/E:U/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
4.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
2.1 Low (REDHAT CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P)
1.7 Low (REDHAT Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Consequences:Other
References:Source: secalert@redhat.com
Type: Exploit
secalert@redhat.com

Source: MITRE
Type: CNA
CVE-2009-1189

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: VMware Security Announcements
VMSA-2010-0004 ESX Service Console and vMA third party updates

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: RHSA-2010-0018
Moderate: dbus security update

Source: CCN
Type: SA32127
D-Bus "_dbus_validate_signature_with_reason()" Denial of Service

Source: CCN
Type: SA38794
VMware vMA Update for Multiple Packages

Source: DEBIAN
Type: DSA-1837
dbus -- programming error

Source: CCN
Type: freedesktop Web site
Reference Implementation (dbus-daemon and libdbus)

Source: secalert@redhat.com
Type: Patch, Vendor Advisory
secalert@redhat.com

Source: CCN
Type: oss-security Mailing List, Thu, 16 Apr 2009 11:47:22 -0600
CVE-2009-1189: invalid fix for CVE-2008-3834 (dbus)

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: BID-31602
D-Bus 'dbus_signature_validate()' Type Signature Denial of Service Vulnerability

Source: secalert@redhat.com
Type: Exploit
secalert@redhat.com

Source: CCN
Type: USN-799-1
D-Bus vulnerability

Source: secalert@redhat.com
Type: Vendor Advisory
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: XF
Type: UNKNOWN
dbus-dbusmarshalvalidate-spoofing(50385)

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: SUSE
Type: SUSE-SR:2011:008
SUSE Security Summary Report

Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*
    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:5::client_workstation:*:*:*:*:*
    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20091189
    V
    		CVE-2009-1189
    2022-05-20
    oval:org.opensuse.security:def:42289
    P
    		Security update for libxml2 (Important)
    2022-05-19
    oval:org.opensuse.security:def:32290
    P
    		Security update for apache2 (Important)
    2022-01-12
    oval:org.opensuse.security:def:26223
    P
    		Security update for net-snmp (Important)
    2022-01-05
    oval:org.opensuse.security:def:32241
    P
    		Security update for the Linux Kernel (Live Patch 40 for SLE 12 SP3) (Important)
    2021-12-14
    oval:org.opensuse.security:def:31716
    P
    		Security update for mozilla-nss (Important)
    2021-12-06
    oval:org.opensuse.security:def:26164
    P
    		Security update for MozillaFirefox (Important)
    2021-11-17
    oval:org.opensuse.security:def:33033
    P
    		Security update for python (Moderate)
    2021-10-26
    oval:org.opensuse.security:def:26150
    P
    		Security update for util-linux (Moderate)
    2021-10-20
    oval:org.opensuse.security:def:26142
    P
    		Security update for apache2 (Important)
    2021-10-06
    oval:org.opensuse.security:def:32185
    P
    		Security update for ghostscript (Critical)
    2021-09-21
    oval:org.opensuse.security:def:32169
    P
    		Security update for the Linux Kernel (Live Patch 34 for SLE 12 SP3) (Important)
    2021-08-25
    oval:org.opensuse.security:def:31661
    P
    		Security update for webkit2gtk3 (Important)
    2021-08-03
    oval:org.opensuse.security:def:31659
    P
    		Security update for qemu (Important)
    2021-07-29
    oval:org.opensuse.security:def:31237
    P
    		Security update for the Linux Kernel (Live Patch 34 for SLE 12 SP3) (Important)
    2021-07-27
    oval:org.opensuse.security:def:32125
    P
    		Security update for the Linux Kernel (Live Patch 38 for SLE 12 SP3) (Important)
    2021-06-18
    oval:org.opensuse.security:def:42090
    P
    		Security update for containerd, docker, runc (Important)
    2021-06-11
    oval:org.opensuse.security:def:36109
    P
    		dbus-1-1.2.10-3.31.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42516
    P
    		dbus-1-1.2.10-3.31.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36389
    P
    		dbus-1-devel-1.2.10-3.31.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:32103
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-06-04
    oval:org.opensuse.security:def:26062
    P
    		Security update for djvulibre (Important)
    2021-05-31
    oval:org.opensuse.security:def:31163
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-04-28
    oval:org.opensuse.security:def:31152
    P
    		Security update for qemu (Important)
    2021-04-16
    oval:org.opensuse.security:def:31605
    P
    		Security update for xorg-x11-server (Important)
    2021-04-14
    oval:org.opensuse.security:def:31151
    P
    		Security update for clamav (Important)
    2021-04-14
    oval:org.opensuse.security:def:32064
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-04-07
    oval:org.opensuse.security:def:31369
    P
    		Security update for MozillaFirefox (Important)
    2021-03-31
    oval:org.opensuse.security:def:31361
    P
    		Security update for the Linux Kernel (Live Patch 35 for SLE 12 SP3) (Important)
    2021-03-17
    oval:org.opensuse.security:def:26208
    P
    		Security update for git (Important)
    2021-03-09
    oval:org.opensuse.security:def:31350
    P
    		Security update for python-cryptography (Important)
    2021-03-02
    oval:org.opensuse.security:def:31349
    P
    		Security update for MozillaFirefox (Important)
    2021-03-01
    oval:org.opensuse.security:def:33072
    P
    		Security update for openvswitch (Important)
    2021-02-12
    oval:org.opensuse.security:def:26111
    P
    		Security update for cups (Moderate)
    2021-02-02
    oval:org.opensuse.security:def:26084
    P
    		Security update for postgresql, postgresql12, postgresql13 (Important)
    2021-01-26
    oval:org.opensuse.security:def:32015
    P
    		Security update for openssl (Important)
    2020-12-11
    oval:org.opensuse.security:def:35683
    P
    		dbus-1-1.2.10-3.23.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35882
    P
    		dbus-1-1.2.10-3.27.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:25966
    P
    		Security update for python-setuptools (Important)
    2020-12-02
    oval:org.opensuse.security:def:26000
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27387
    P
    		dbus-1-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25943
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:27352
    P
    		sblim-sfcb-openssl1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25862
    P
    		Recommended update for mariadb (Important)
    2020-12-01
    oval:org.opensuse.security:def:26714
    P
    		gstreamer-0_10-plugins-good on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25734
    P
    		Security update for python3 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32029
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26670
    P
    		apache2-mod_php5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25670
    P
    		Security update for ucode-intel (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31942
    P
    		Security update for gnome-session (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26656
    P
    		zoo on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25659
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31885
    P
    		Security update for ecryptfs-utils (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26617
    P
    		nagios on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26683
    P
    		dbus-1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25658
    P
    		Security update for liblouis (Low)
    2020-12-01
    oval:org.opensuse.security:def:31793
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:26568
    P
    		java-1_6_0-ibm on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26648
    P
    		wget on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26515
    P
    		MozillaFirefox on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26010
    P
    		Security update for libvirt (Important)
    2020-12-01
    oval:org.opensuse.security:def:31587
    P
    		Security update for tcpdump (Important)
    2020-12-01
    oval:org.opensuse.security:def:26364
    P
    		Security update for irssi (Low)
    2020-12-01
    oval:org.opensuse.security:def:31576
    P
    		Security update for sudo (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26280
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25952
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:32648
    P
    		dbus-1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31575
    P
    		Security update for sudo
    2020-12-01
    oval:org.opensuse.security:def:25913
    P
    		Security update for tcpdump, libpcap (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32609
    P
    		tar on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25864
    P
    		Security update for php5 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31971
    P
    		Security update for jakarta-commons-collections (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26014
    P
    		Security update for mariadb (Important)
    2020-12-01
    oval:org.opensuse.security:def:25811
    P
    		Security update for libvirt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31927
    P
    		Security update for giflib (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25950
    P
    		Security update for evince (Important)
    2020-12-01
    oval:org.opensuse.security:def:25660
    P
    		Security update for sane-backends (Important)
    2020-12-01
    oval:org.opensuse.security:def:31905
    P
    		Security update for freeradius-server (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25939
    P
    		Security update for gstreamer-0_10-plugins-base (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25576
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:31866
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26881
    P
    		dbus-1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25938
    P
    		Security update for evince (Important)
    2020-12-01
    oval:org.opensuse.security:def:25519
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31817
    P
    		Security update for atftp (Important)
    2020-12-01
    oval:org.opensuse.security:def:26846
    P
    		xterm on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25438
    P
    		Security update for binutils (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31761
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:25310
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:25246
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:31518
    P
    		Security update for quagga (Important)
    2020-12-01
    oval:org.opensuse.security:def:32846
    P
    		dbus-1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25235
    P
    		Security update for java-1_7_1-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:31461
    P
    		Security update for postgresql94 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32807
    P
    		xen on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25234
    P
    		Security update for dnsmasq (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26009
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25858
    P
    		Security update for util-linux (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25774
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:27107
    P
    		dbus-1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25717
    P
    		Security update for gd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27072
    P
    		OpenEXR on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25636
    P
    		Security update for libproxy (Important)
    2020-12-01
    oval:org.opensuse.security:def:31959
    P
    		Security update for gtk2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26434
    P
    		Security update for pdns (Important)
    2020-12-01
    oval:org.opensuse.security:def:25508
    P
    		Security update for mailman (Important)
    2020-12-01
    oval:org.opensuse.security:def:31803
    P
    		Security update for amanda (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26390
    P
    		Security update for ark (Low)
    2020-12-01
    oval:org.opensuse.security:def:25444
    P
    		Security update for sysstat (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26376
    P
    		Security update for MozillaThunderbird (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25433
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:26337
    P
    		Security update for freexl (Low)
    2020-12-01
    oval:org.opensuse.security:def:25432
    P
    		Security update for ibus (Important)
    2020-12-01
    oval:org.opensuse.security:def:31567
    P
    		Security update for squid3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:26288
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32395
    P
    		Security update for unrar (Important)
    2020-12-01
    oval:org.opensuse.security:def:31435
    P
    		Security update for php53 (Important)
    2020-12-01
    oval:org.opensuse.security:def:26235
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32351
    P
    		Security update for squid (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32329
    P
    		Security update for samba (Moderate)
    2020-12-01
    oval:org.mitre.oval:def:13931
    P
    		USN-799-1 -- dbus vulnerability
    2014-06-30
    oval:org.mitre.oval:def:13451
    P
    		DSA-1837-1 dbus -- programming error
    2014-06-23
    oval:org.mitre.oval:def:7908
    P
    		DSA-1837 dbus -- programming error
    2014-06-23
    oval:org.mitre.oval:def:22736
    P
    		ELSA-2010:0018: dbus security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:21815
    P
    		RHSA-2010:0018: dbus security update (Moderate)
    2014-02-24
    oval:org.mitre.oval:def:10308
    V
    		The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.
    2013-04-29
    oval:com.redhat.rhsa:def:20100018
    P
    		RHSA-2010:0018: dbus security update (Moderate)
    2010-01-07
    oval:org.debian:def:1837
    V
    		programming error
    2009-07-18
    BACK