CVE-2019-12749 (retired)

Priority
Description
dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as
used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less
common, uses of dbus-daemon), allows cookie spoofing because of symlink
mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the
libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication
mechanism.) A malicious client with write access to its own home directory
could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a
different uid to read and write in unintended locations. In the worst case,
this could result in the DBusServer reusing a cookie that is known to the
malicious client, and treating that cookie as evidence that a subsequent
client connection came from an attacker-chosen uid, allowing authentication
bypass.
Assigned-to
mdeslaur
More Information

Updated: 2019-06-18 14:15:00 UTC (commit 9f807c94b6fc41f37f6d5a87a9f9bf48675250e0)