Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.6

D-Bus default settings let local users bypass restrictions

CVE-2008-4311 · published 17 years ago
Summary

On Debian systems using D-Bus versions older than 1.2.6, the default configuration misses a setting that should limit what local users can do. Because of this, a user who has normal access to the computer can send or receive messages that were meant to be blocked, potentially gaining higher privileges or interfering with other applications. Update D-Bus to version 1.2.6 or later, or manually add the missing restriction to the configuration file, to close the gap.

What to do
  • Update debian dbus to version 1.2.1-5.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian dbus < 1.2.1-5
Fix: upgrade to 1.2.1-5
Debian:13 debian dbus < 1.2.1-5
Fix: upgrade to 1.2.1-5
Debian:14 debian dbus < 1.2.1-5
Fix: upgrade to 1.2.1-5
– freedesktop dbus <= 1.2.4
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
0.11
0.12
26 more version ranges
cpe:2.3:a:freedesktop:dbus:*:*:*:*:*:*:*:*
Original advisory text
The default configuration of system.conf in D-Bus (aka DBus) before 1.2.6 omits the send_type attribute in certain rules, which allows local users to bypass intended access restrictions by (1) send...
The default configuration of system.conf in D-Bus (aka DBus) before 1.2.6 omits the send_type attribute in certain rules, which allows local users to bypass intended access restrictions by (1) sending messages, related to send_requested_reply; and possibly (2) receiving messages, related to receive_requested_reply.
References
Severity
4.6 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-16Configuration
Timeline
Published10 Dec 2008
Updated4 Nov 2026
First seen20 Sep 2026
Sources
DEBIAN-CVE-2008-4311 · OSV
CVE-2008-4311 · NVD
Track software like this
Free during beta