CVE-2014-3477

Description

From CVE.org

The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.

Statement

This issue affect the dbus package in Red Hat Enterprise Linux 5, 6, 7. Red Hat Product Security has rated this issue as having Moderate security impact, a future update my address this flaw in Red Hat Enterprise Linux 6 and 7. This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle, https://access.redhat.com/support/policy/updates/errata/

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v2 Score Breakdown

Red HatNVDcve.org
Base Score3.62.1N/A
Attack VectorLocalLocalN/A
Access ComplexityLowLowN/A
AuthenticationNoneNoneN/A
Confidentiality ImpactNoneNoneN/A
Integrity ImpactPartialNoneN/A
Availability ImpactPartialPartialN/A

Vector

Red Hat: AV:L/AC:L/Au:N/C:N/I:P/A:P

NVD: AV:L/AC:L/Au:N/C:N/I:N/A:P

Acknowledgements

Red Hat would like to thank D-Bus upstream for reporting this issue. Upstream acknowledges Alban Crequy (Collabora Ltd.) as the original reporter.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.