CVE-2009-1189: Input Validation
Published Apr 27, 2009
·Updated
The dbusvalidatesignaturewithreason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.
Affected Software
49 affected components
Freedesktop dbus<=1.2.3
Freedesktop dbus=0.1
Freedesktop dbus=0.2
Freedesktop dbus=0.3
Freedesktop dbus=0.4
Freedesktop dbus=0.5
Freedesktop dbus=0.6
Freedesktop dbus=0.7
Freedesktop dbus=0.8
Freedesktop dbus=0.9
Freedesktop dbus=0.10
Freedesktop dbus=0.11
Freedesktop dbus=0.12
Freedesktop dbus=0.13
Freedesktop dbus=0.20
Freedesktop dbus=0.21
Freedesktop dbus=0.22
Freedesktop dbus=0.23
Freedesktop dbus=0.23.1
Freedesktop dbus=0.23.2
Freedesktop dbus=0.23.3
Freedesktop dbus=0.31
Freedesktop dbus=0.32
Freedesktop dbus=0.33
Freedesktop dbus=0.34
Freedesktop dbus=0.35
Freedesktop dbus=0.35.1
Freedesktop dbus=0.35.2
Freedesktop dbus=0.36
Freedesktop dbus=0.36.1
Freedesktop dbus=0.36.2
Freedesktop dbus=0.50
Freedesktop dbus=0.60
Freedesktop dbus=0.61
Freedesktop dbus=0.62
Freedesktop dbus=0.90
Freedesktop dbus=0.91
Freedesktop dbus=0.92
Freedesktop dbus=1.0
Freedesktop dbus=1.0-rc1
Freedesktop dbus=1.0-rc2
Freedesktop dbus=1.0-rc3
Freedesktop dbus=1.0.2
Freedesktop dbus=1.1.0
Freedesktop dbus=1.1.1
Freedesktop dbus=1.1.2
Freedesktop dbus=1.1.4
Freedesktop dbus=1.1.20
Freedesktop dbus=1.2.1
Remediation
Event History
Apr 27, 2009
CVE Published
via MITRE·05:43 PM
Data Sourced
via MITRE·05:43 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-1189?
CVE-2009-1189 is considered to have a moderate severity due to its ability to allow remote attackers to spoof signatures.
2
How do I fix CVE-2009-1189?
To fix CVE-2009-1189, you should upgrade to D-Bus version 1.2.14 or later.
3
Which versions of D-Bus are affected by CVE-2009-1189?
All versions of D-Bus prior to 1.2.14 are affected by CVE-2009-1189.
4
What is the impact of CVE-2009-1189?
The impact of CVE-2009-1189 includes potential signature spoofing, which could compromise system integrity.
5
Is there a workaround for CVE-2009-1189?
There are no known workarounds for CVE-2009-1189 other than applying the proper software updates.