medium
4.6
CWE
20
Advisory Published
CVE Published
Updated

CVE-2011-2200: Input Validation

First published: Sun Jun 12 2011(Updated: )

The _dbus_header_byteswap function in dbus-marshal-header.c in D-Bus (aka DBus) 1.2.x before 1.2.28, 1.4.x before 1.4.12, and 1.5.x before 1.5.4 does not properly handle a non-native byte order, which allows local users to cause a denial of service (connection loss), obtain potentially sensitive information, or conduct unspecified state-modification attacks via crafted messages.

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
redhat/dbus<1.1.28
1.1.28
redhat/dbus<1.4.12
1.4.12
redhat/dbus<1.5.4
1.5.4
dbus=1.5.0
dbus=1.5.2
dbus=1.4.8
dbus=1.4.1
dbus=1.4.0
dbus=1.4.6
dbus=1.4.10
dbus=1.4.4
dbus=1.2.4.2
dbus=1.2.1
dbus=1.2.14
dbus=1.2.4
dbus=1.2.4.4
dbus=1.2.2
dbus=1.2.10
dbus=1.2.8
dbus=1.2.12
dbus=1.2.26
dbus=1.2.24
dbus=1.2.22
dbus=1.2.4.6
dbus=1.2.6
dbus=1.2.20
dbus=1.2.16
dbus=1.2.18
dbus=1.2.3
Freedesktop D-Bus=1.5.0
Freedesktop D-Bus=1.5.2
Freedesktop D-Bus=1.4.0
Freedesktop D-Bus=1.4.1
Freedesktop D-Bus=1.4.4
Freedesktop D-Bus=1.4.6
Freedesktop D-Bus=1.4.8
Freedesktop D-Bus=1.4.10
Freedesktop D-Bus=1.2.1
Freedesktop D-Bus=1.2.2
Freedesktop D-Bus=1.2.3
Freedesktop D-Bus=1.2.4
Freedesktop D-Bus=1.2.6
Freedesktop D-Bus=1.2.8
Freedesktop D-Bus=1.2.10
Freedesktop D-Bus=1.2.12
Freedesktop D-Bus=1.2.14
Freedesktop D-Bus=1.2.16
Freedesktop D-Bus=1.2.18
Freedesktop D-Bus=1.2.20
Freedesktop D-Bus=1.2.22
Freedesktop D-Bus=1.2.24
Freedesktop D-Bus=1.2.26

Remedy

http://cgit.freedesktop.org/dbus/dbus/commit/?h=dbus-1.2&id=6519a1f77c61d753d4c97efd6e15630eb275336e

Remedy

http://cgit.freedesktop.org/dbus/dbus/commit/?h=dbus-1.4&id=c3223ba6c401ba81df1305851312a47c485e6cd7

Remedy

http://cgit.freedesktop.org/dbus/dbus/tree/NEWS?h=dbus-1.2

Remedy

http://openwall.com/lists/oss-security/2011/06/12/1

Remedy

http://openwall.com/lists/oss-security/2011/06/13/12

Remedy

https://bugzilla.redhat.com/show_bug.cgi?id=712676

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2011-2200?

    CVE-2011-2200 has a high severity level as it can cause denial of service due to improper handling of non-native byte order.

  • How do I fix CVE-2011-2200?

    To fix CVE-2011-2200, you should update D-Bus to version 1.2.28 or later for the 1.2.x series, 1.4.12 or later for the 1.4.x series, or 1.5.4 or later for the 1.5.x series.

  • What software versions are affected by CVE-2011-2200?

    CVE-2011-2200 affects D-Bus versions prior to 1.2.28, 1.4.12, and 1.5.4.

  • Can CVE-2011-2200 be exploited remotely?

    No, CVE-2011-2200 can only be exploited by local users.

  • What are the consequences of CVE-2011-2200?

    The consequences of CVE-2011-2200 include denial of service, which may result in connection loss.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203