CVE-2019-12749

dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.

• CVE ID
• CVE-2019-12749

• Assigner
• cve@mitre.org

• Vulnerability Status
• Modified

• Published Version
• 2019-06-11T17:29:00

• Last Modified Date
• 2020-08-24T17:37:01

• Version
• 2.0

• Vector String
• AV:L/AC:L/Au:N/C:P/I:P/A:N

• Access Vector
• LOCAL

• Access Compatibility
• LOW

• Authentication
• NONE

• Confidentiality Impact
• PARTIAL

• Integrity Impact
• PARTIAL

• Availability Impact
• NONE

• Base Score
• 3.6

• Severity
• LOW

• Exploitability Score
• 3.9

• Impact Score
• 4.9

• Version
• 3.0

• Vector String
• CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

• Attack Vector
• LOCAL

• Attack Compatibility
• LOW

• Privileges Required
• LOW

• User Interaction
• NONE

• Scope
• UNCHANGED

• Confidentiality Impact
• HIGH

• Availability Impact
• NONE

• Base Score
• 7.1

• Base Severity
• HIGH

• Exploitability Score
• 1.8

• Impact Score
• 5.2