CVE-2009-1189: freedesktop dbus Improper Input Validation

CVSS: 3.6v2.0LowModified

AliasesRHSA-2010:0018DEBIAN-CVE-2009-1189DSA-1837-1

Published 27-04-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-1189 is a low (CVSS 3.6) Improper Input Validation vulnerability in freedesktop dbus. EPSS estimates a 1.32% chance of exploitation in the next 30 days, higher than 70.4% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

25/100

0100

Medium · default modelHow is this calculated?

CVSS score

3.6/10

010

Low · v2.0 (NVD)

EPSS score

1.32%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference

Timeline

27-04-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.

CVSS metrics

1 score · 1 source · 1 version

v2.03.6

EPSS trend

Probability

1.32%

Chance of exploitation in the next 30 days

Percentile

70%

Versus all other CVEs

30-day change

0.00 pp

From 1.32% on 19-09-2026

19-09-202619-10-2026

EPSS score

1.32%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (bugs.freedesktop.org)
Maturity: unknown
referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Redhat5 products

dbus< 0:1.1.2-12.el5_4.1
dbus-debuginfo< 0:1.1.2-12.el5_4.1
dbus-devel< 0:1.1.2-12.el5_4.1
dbus-libs< 0:1.1.2-12.el5_4.1
dbus-x11< 0:1.1.2-12.el5_4.1

Debian1 product

dbus< 1.2.14-1 | < 1.0.2-1+etch3 | < 1.2.1-5+lenny1

Freedesktop1 product

dbus≤ 1.2.3 | 0.1 | 0.2 | 0.3 | 0.4 | 0.5 | 0.6 | 0.7 | 0.8 | 0.9 | 0.10 | 0.11 | 0.12 | 0.13 | 0.20 | 0.21 | 0.22 | 0.23 | 0.23.1 | 0.23.2 | 0.23.3 | 0.31 | 0.32 | 0.33 | 0.34 | 0.35 | 0.35.1 | 0.35.2 | 0.36 | 0.36.1 | 0.36.2 | 0.50 | 0.60 | 0.61 | 0.62 | 0.90 | 0.91 | 0.92 | 1.0 | 1.0:rc1 | 1.0:rc2 | 1.0:rc3 | 1.0.2 | 1.1.0 | 1.1.1 | 1.1.2 | 1.1.4 | 1.1.20 | 1.2.1

3 vendors · 7 products