CVE-2010-4352: Low severity dbus vulnerability
A stack overflow flaw was found in the way the D-BUS message bus service / messaging facility validated messages with excessive number of nested variants. A local, authenticated user could use this flaw to cause dbus daemon to crash (denial of service) via a specially-crafted message sent to the system bus. References: [1] http://www.remlab.net/op/dbus-variant-recursion.shtml Upstream bug report: [2] https://bugs.freedesktop.org/showbug.cgi?id=32321 CVE Request: [3] http://www.openwall.com/lists/oss-security/2010/12/16/3
Credit: Rémi Denis-Courmont
Other sources
Stack consumption vulnerability in D-Bus (aka DBus) before 1.4.1 allows local users to cause a denial of service (daemon crash) via a message containing many nested variants.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4352?
CVE-2010-4352 is classified as a denial of service vulnerability due to a stack overflow issue in the D-BUS service.
How do I fix CVE-2010-4352?
To mitigate CVE-2010-4352, upgrade to a version of D-BUS that is newer than 1.4.0 where the vulnerability is patched.
Who is affected by CVE-2010-4352?
CVE-2010-4352 affects local authenticated users on systems running D-BUS versions up to and including 1.4.0.
What could an attacker achieve with CVE-2010-4352?
An attacker leveraging CVE-2010-4352 could crash the D-BUS daemon, resulting in a denial of service on the affected system.
When was CVE-2010-4352 discovered?
CVE-2010-4352 was reported on December 20, 2010.