What’s Vulnerable › Vulnerabilities

CVE-2008-0595

• Severity: medium (CVSS 4.6 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2008-02-29 · updated 2026-06-16
• Weakness: CWE-863

Description

dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.

Affected products

• Fedoraproject Fedora: 7
• Freedesktop Dbus: before 1.0.3; from 1.1.0 before 1.1.20 — fixed in 1.0.3, 1.1.20
• Mandrakesoft Mandrake Linux: 2007, 2007.0_x86_64, 2007.1, 2008.0
• Red Hat Enterprise Linux: 5, 5.0

How to fix

Upgrade to a fixed version: Freedesktop Dbus 1.0.3, 1.1.20. Check the vendor advisory for mitigations.

References

• http://lists.freedesktop.org/archives/dbus/2008-February/009401.html
• http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00004.html
• http://lists.opensuse.org/opensuse-updates/2012-10/msg00094.html
• http://secunia.com/advisories/29148
• http://secunia.com/advisories/29160
• http://secunia.com/advisories/29171
• http://secunia.com/advisories/29173
• http://secunia.com/advisories/29281
• http://secunia.com/advisories/29323
• http://secunia.com/advisories/30869
• http://secunia.com/advisories/32281
• http://securitytracker.com/id?1019512

Get alerted when CVE-2008-0595 or the next vulnerability affects your stack