Description
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dbus | 1.1.20-1 | — |
| Debian 13 | dbus | 1.1.20-1 | — |
| Debian 12 | dbus | 1.1.20-1 | — |
| Debian 4.0 | dbus | 1.0.2-1+etch1 | DSA-1599-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | dbus +2 | 1.0.0-6.3.el5_1 | RHSA-2008:0159 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dbus-1 | 1.12.20-5.5 | openSUSE-SU-2024:10711-1 |
Advisories 3
- RHSA-2008:0159 Red Hat Security Advisory: dbus security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1599-1 dbus Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10711-1 dbus-1-1.12.20-5.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 29281 third-party-advisory
- ADV-2008-0694 vdb-entry
- RHSA-2008:0159 vendor-advisory
- openSUSE-SU-2012:1418 vendor-advisory
- [dbus] 20080227 [ANNOUNCE] CVE-2008-0595 D-Bus Security Releases - D-Bus 1.0.3 and D-Bus 1.1.20 mailing-list
- 29160 third-party-advisory
- 29148 third-party-advisory
- http://www.j5live.com/2008/02/27/announce-d-bus-1120-conisten-water-released/
- FEDORA-2008-2043 vendor-advisory
- 29173 third-party-advisory
- MDVSA-2008:054 vendor-advisory
- 29171 third-party-advisory
- 20080307 rPSA-2008-0099-1 dbus dbus-glib dbus-qt dbus-x11 mailing-list
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0099
- oval:org.mitre.oval:def:9353 vdb-entry signature
- 1019512 vdb-entry
- SUSE-SR:2008:006 vendor-advisory
- 32281 third-party-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0099
- FEDORA-2008-2070 vendor-advisory
- DSA-1599 vendor-advisory
- 29323 third-party-advisory
- https://issues.rpath.com/browse/RPL-2282
- 30869 third-party-advisory
- 28023 vdb-entry
- USN-653-1 vendor-advisory