CVE-2008-3834: Input Validation
Published Oct 7, 2008
·Updated
The dbussignaturevalidate function in the D-bus library (libdbus) before 1.2.4 allows remote attackers to cause a denial of service (application abort) via a message containing a malformed signature, which triggers a failed assertion error.
Affected Software
44 affected components
Freedesktop dbus<=1.1.4
Freedesktop dbus=0.1
Freedesktop dbus=0.2
Freedesktop dbus=0.3
Freedesktop dbus=0.4
Freedesktop dbus=0.5
Freedesktop dbus=0.6
Freedesktop dbus=0.7
Freedesktop dbus=0.8
Freedesktop dbus=0.9
Freedesktop dbus=0.10
Freedesktop dbus=0.11
Freedesktop dbus=0.12
Freedesktop dbus=0.13
Freedesktop dbus=0.20
Freedesktop dbus=0.21
Freedesktop dbus=0.22
Freedesktop dbus=0.23
Freedesktop dbus=0.23.1
Freedesktop dbus=0.23.2
Freedesktop dbus=0.23.3
Freedesktop dbus=0.31
Freedesktop dbus=0.32
Freedesktop dbus=0.33
Freedesktop dbus=0.34
Freedesktop dbus=0.35
Freedesktop dbus=0.35.1
Freedesktop dbus=0.35.2
Freedesktop dbus=0.36
Freedesktop dbus=0.36.1
Freedesktop dbus=0.36.2
Freedesktop dbus=0.50
Freedesktop dbus=0.61
Freedesktop dbus=0.62
Freedesktop dbus=0.90
Freedesktop dbus=0.91
Freedesktop dbus=0.92
Freedesktop dbus=1.0.2
Freedesktop dbus=1.1.1
Freedesktop dbus=1.1.2
Freedesktop Dbus1.0=rc1
Freedesktop Dbus1.0=rc2
Freedesktop Dbus1.0=rc3
Freedesktop Dbus1.1.0
Event History
Oct 7, 2008
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-3834?
CVE-2008-3834 has been classified as a denial of service vulnerability that may lead to application aborts.
2
How do I fix CVE-2008-3834?
To mitigate CVE-2008-3834, you should upgrade the D-bus library to version 1.2.4 or later.
3
What causes CVE-2008-3834?
CVE-2008-3834 is caused by the dbus_signature_validate function failing to properly handle malformed signatures.
4
Which versions are affected by CVE-2008-3834?
CVE-2008-3834 affects D-bus versions prior to 1.2.4, including 0.1 through 1.1.4.
5
Is CVE-2008-3834 exploitable remotely?
Yes, CVE-2008-3834 can be exploited remotely by sending a message with a malformed signature.