Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

usbguard: CVE-2019-25058: unauthorized access via D-Bus

Related Vulnerabilities: CVE-2019-25058  

Source

Debian Bug report logs - #1008026
usbguard: CVE-2019-25058: unauthorized access via D-Bus

version graph

Package: usbguard; Maintainer for usbguard is Birger Schacht <birger@debian.org>; Source for usbguard is src:usbguard (PTS, buildd, popcon).

Reported by: Markus Koschany <apo@debian.org>

Date: Sun, 20 Mar 2022 19:03:01 UTC

Severity: grave

Tags: fixed-upstream, security, upstream

Found in versions usbguard/0.6.2+ds1-2, usbguard/1.0.0+ds-2, usbguard/0.7.4+ds-1

Fixed in version usbguard/1.1.0+ds-1

Done: Markus Koschany <apo@debian.org>

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, team@security.debian.org, Birger Schacht <birger@debian.org>:
Bug#1008026; Package usbguard. (Sun, 20 Mar 2022 19:03:03 GMT) (full text, mbox, link).

Acknowledgement sent to Markus Koschany <apo@debian.org>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, Birger Schacht <birger@debian.org>. (Sun, 20 Mar 2022 19:03:03 GMT) (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>
To: submit <submit@bugs.debian.org>
Subject: usbguard: CVE-2019-25058: unauthorized access via D-Bus
Date: Sun, 20 Mar 2022 20:01:27 +0100
[Message part 1 (text/plain, inline)]
Package: usbguard
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerability was published for usbguard.

CVE-2019-25058[0]:
| An issue was discovered in USBGuard before 1.1.0. On systems with the
| usbguard-dbus daemon running, an unprivileged user could make USBGuard
| allow all USB devices to be connected in the future.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-25058
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25058

Please adjust the affected versions in the BTS as needed.

Regards,

Markus

[signature.asc (application/pgp-signature, inline)]

Added tag(s) upstream and fixed-upstream. Request was from Markus Koschany <apo@debian.org> to control@bugs.debian.org. (Sun, 20 Mar 2022 19:09:05 GMT) (full text, mbox, link).

Marked as found in versions usbguard/0.6.2+ds1-2. Request was from Markus Koschany <apo@debian.org> to control@bugs.debian.org. (Sun, 20 Mar 2022 19:09:05 GMT) (full text, mbox, link).

Marked as found in versions usbguard/0.7.4+ds-1. Request was from Markus Koschany <apo@debian.org> to control@bugs.debian.org. (Sun, 20 Mar 2022 19:09:06 GMT) (full text, mbox, link).

Marked as found in versions usbguard/1.0.0+ds-2. Request was from Markus Koschany <apo@debian.org> to control@bugs.debian.org. (Sun, 20 Mar 2022 19:09:06 GMT) (full text, mbox, link).

Marked as fixed in versions usbguard/1.1.0+ds-1. Request was from Markus Koschany <apo@debian.org> to control@bugs.debian.org. (Sun, 20 Mar 2022 19:09:07 GMT) (full text, mbox, link).

Marked Bug as done Request was from Markus Koschany <apo@debian.org> to control@bugs.debian.org. (Sun, 20 Mar 2022 19:09:07 GMT) (full text, mbox, link).

Notification sent to Markus Koschany <apo@debian.org>:
Bug acknowledged by developer. (Sun, 20 Mar 2022 19:09:08 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Mon Mar 21 13:09:36 2022; Machine Name: bembo

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started