D-Bus Remote Signature Spoofing Vulnerability Affecting Freedesktop.org
CVE-2009-1189

Currently unrated

Key Information:

Vendor: Freedesktop
Status: Dbus
Vendor: CVE Published:; 27 April 2009

🔔 Create Freedesktop Vulnerability Alert

What is CVE-2009-1189?

A security flaw exists in the D-Bus system due to incorrect logic in the _dbus_validate_signature_with_reason function. This vulnerability permits remote attackers to create a bogus signature using a specially crafted key, undermining the integrity of the signing process. This flaw originated from a defective resolution to a prior issue (CVE-2008-3834), allowing exploitation in versions prior to 1.2.14.

References

http://www.openwall.com/lists/oss-security/2009/04/16/13

mailing-listx_refsource_MLIST

https://exchange.xforce.ibmcloud.com/vulnerabilities/50385

vdb-entryx_refsource_XF

http://bugs.freedesktop.org/show_bug.cgi?id=17803

x_refsource_CONFIRM

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 27, 2009
Vulnerability Reserved
Mar 31, 2009