CVE-2013-2168: Input Validation
A denial of service flaw was found in the way UNIX system D-BUS format string wrapper implementation of D-BUS, a system for sending messages between applications, used to measure the length of the provided format string and its arguments in certain circumstances. A remote attacker could supply a specially-crafted input to an application / service, utilizing the services / functionality of the libdbus library that, when processed would lead to that application / service crash.
References: [1] http://www.openwall.com/lists/oss-security/2013/06/13/2
Relevant upstream patch: [2] http://cgit.freedesktop.org/dbus/dbus/commit/?id=954d75b2b64e4799f360d2a6bf9cff6d9fee37e7
Other sources
The dbusprintfstringupperbound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2168?
CVE-2013-2168 is classified as a denial of service vulnerability that can be exploited remotely.
How do I fix CVE-2013-2168?
To fix CVE-2013-2168, update the D-BUS package to version 1.4.26, 1.6.12, or 1.7.4 or later.
Which software is affected by CVE-2013-2168?
D-BUS versions prior to 1.4.26, 1.6.12, and 1.7.4 are affected by CVE-2013-2168.
What can an attacker do with CVE-2013-2168?
An attacker can exploit CVE-2013-2168 to cause a denial of service, affecting application communication over D-BUS.
Is CVE-2013-2168 a local or remote vulnerability?
CVE-2013-2168 is a remote vulnerability that allows attackers to send malicious D-BUS messages.