CVE-2008-0595: fedoraproject fedora Incorrect Authorization
CVSS: 4.6v2.0MediumModified
AliasesRHSA-2008:0159DEBIAN-CVE-2008-0595DSA-1599-1
Published 29-02-2008Last modified 07-08-2024
Vulnerability summary
CVE-2008-0595 is a medium (CVSS 4.6) Incorrect Authorization vulnerability in fedoraproject fedora. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.2% of scored vulnerabilities.
CVSS score
4.6/10
010
Medium · v2.0 (NVD)EPSS score
0.40%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 29-02-2008PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
CVSS metrics
1 score · 1 source · 1 versionMedium 4.6Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
0.00 pp
From 0.40% on 19-09-2026
19-09-202619-10-2026
EPSS score0.40%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat5 products
- enterprise_linuxEOL5 | 5.0
- dbus< 0:1.0.0-6.3.el5_1
- dbus-debuginfo< 0:1.0.0-6.3.el5_1
- dbus-devel< 0:1.0.0-6.3.el5_1
- dbus-x11< 0:1.0.0-6.3.el5_1
Debian1 product
- dbus< 1.1.20-1 | < 1.0.2-1+etch1
Fedoraproject1 product
- fedoraEOL7
Freedesktop1 product
- dbus< 1.0.3 | ≥ 1.1.0, < 1.1.20
Mandrakesoft1 product
- mandrake_linux2007 | 2007.0_x86_64 | 2007.1 | 2008.0
5 vendors · 9 products
References
34 links- www.redhat.com/support/errata/RHSA-2008-0159.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
- lists.opensuse.org/opensuse-updates/2012-10/msg00094.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.freedesktop.org/archives/dbus/2008-February/009401.htmlMailing ListX Refsource MLISTPatchThird Party Advisory
- www.j5live.com/2008/02/27/announce-d-bus-1120-conisten-water-released/X Refsource CONFIRMThird Party Advisory
- www.redhat.com/archives/fedora-package-announce/2008-February/msg00893.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
Show all 34 references
- www.mandriva.com/security/advisories?name=MDVSA-2008:054Vendor AdvisoryX Refsource MANDRIVABroken Link
- www.securityfocus.com/archive/1/489280/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9353VDB EntrySignatureX Refsource OVALBroken Link
- lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- www.redhat.com/archives/fedora-package-announce/2008-February/msg00911.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory