Description
The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dbus-glib | 0.100.1-1 | — |
| Debian 13 | dbus-glib | 0.100.1-1 | — |
| Debian 12 | dbus-glib | 0.100.1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | dbus-glib +1 | 0.86-6.el6_4 | RHSA-2013:0568 |
| RHEL 5 | dbus-glib +1 | 0.73-11.el5_9 | RHSA-2013:0568 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- dbus-glib pam_fprintd - Local Privilege Escalation EDB-33614 · local · Jun 2, 2014
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2013:0568 Red Hat Security Advisory: dbus-glib security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- 33614 exploit
- MDVSA-2013:071 vendor-advisory
- 52225 third-party-advisory
- dbus-message-sender-priv-esc(82135) vdb-entry
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=911658
- 52375 third-party-advisory
- USN-1753-1 vendor-advisory
- RHSA-2013:0568 vendor-advisory
- 57985 vdb-entry
- 52404 third-party-advisory
- [oss-security] 20130215 CVE-2013-0292: authentication bypass due to insufficient checks in dbus-glib < 0.100.1 mailing-list
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- 90302 vdb-entry
- http://cgit.freedesktop.org/dbus/dbus-glib/commit/?id=166978a09cf5edff4028e670b6074215a4c75eca
- https://bugs.freedesktop.org/show_bug.cgi?id=60916