USN-2352-1

Dashboard / Vulnerabilities / USN-2352-1

USN-2352-1

Summary: dbus vulnerabilities

Details: Simon McVittie discovered that DBus incorrectly handled the file descriptors message limit. A local attacker could use this issue to cause DBus to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-3635) Alban Crequy discovered that DBus incorrectly handled a large number of file descriptor messages. A local attacker could use this issue to cause DBus to stop responding, resulting in a denial of service. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-3636) Alban Crequy discovered that DBus incorrectly handled certain file descriptor messages. A local attacker could use this issue to cause DBus to maintain persistent connections, possibly resulting in a denial of service. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-3637) Alban Crequy discovered that DBus incorrectly handled a large number of parallel connections and parallel message calls. A local attacker could use this issue to cause DBus to consume resources, possibly resulting in a denial of service. (CVE-2014-3638) Alban Crequy discovered that DBus incorrectly handled incomplete connections. A local attacker could use this issue to cause DBus to fail legitimate connection attempts, resulting in a denial of service. (CVE-2014-3639)

References: https://ubuntu.com/security/notices/USN-2352-1, https://ubuntu.com/security/CVE-2014-3635, https://ubuntu.com/security/CVE-2014-3636, https://ubuntu.com/security/CVE-2014-3637, https://ubuntu.com/security/CVE-2014-3638, https://ubuntu.com/security/CVE-2014-3639