Vulnerability   
Search   
    Search 211766 CVE descriptions
and 97459 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.1.4.2014.1146.1
Category:SuSE Local Security Checks
Title:SUSE: Security Advisory (SUSE-SU-2014:1146-1)
Summary:The remote host is missing an update for the 'dbus-1' package(s) announced via the SUSE-SU-2014:1146-1 advisory.
Description:Summary:
The remote host is missing an update for the 'dbus-1' package(s) announced via the SUSE-SU-2014:1146-1 advisory.

Vulnerability Insight:
Various denial of service issues were fixed in the DBUS service.

* CVE-2014-3638: dbus-daemon tracks whether method call messages
expect a reply, so that unsolicited replies can be dropped. As
currently implemented, if there are n parallel method calls in
progress, each method reply takes O(n) CPU time. A malicious user
could exploit this by opening the maximum allowed number of parallel
connections and sending the maximum number of parallel method calls
on each one, causing subsequent method calls to be unreasonably
slow, a denial of service.
* CVE-2014-3639: dbus-daemon allows a small number of 'incomplete'
connections (64 by default) whose identity has not yet been
confirmed. When this limit has been reached, subsequent connections
are dropped. Alban's testing indicates that one malicious process
that makes repeated connection attempts, but never completes the
authentication handshake and instead waits for dbus-daemon to time
out and disconnect it, can cause the majority of legitimate connection attempts to fail.

Security Issues:

* CVE-2014-3638
* CVE-2014-3638

Affected Software/OS:
'dbus-1' package(s) on SUSE Linux Enterprise Software Development Kit 11 SP3, SUSE Linux Enterprise Server 11 SP3, SUSE Linux Enterprise Desktop 11 SP3

Solution:
Please install the updated package(s).

CVSS Score:
2.1

CVSS Vector:
AV:L/AC:L/Au:N/C:N/I:N/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2014-3638
Debian Security Information: DSA-3026 (Google Search)
http://www.debian.org/security/2014/dsa-3026
http://www.mandriva.com/security/advisories?name=MDVSA-2015:176
http://www.openwall.com/lists/oss-security/2014/09/16/9
http://www.securitytracker.com/id/1030864
http://secunia.com/advisories/61378
http://secunia.com/advisories/61431
SuSE Security Announcement: SUSE-SU-2014:1146 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00026.html
SuSE Security Announcement: openSUSE-SU-2014:1239 (Google Search)
http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html
http://www.ubuntu.com/usn/USN-2352-1
Common Vulnerability Exposure (CVE) ID: CVE-2014-3639
CopyrightCopyright (C) 2021 Greenbone Networks GmbH

This is only one of 97459 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.