The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2014-3477 from the MITRE CVE dictionary dictionary and NIST NVD.
This issue affect the dbus package in Red Hat Enterprise Linux 5, 6, 7. Red Hat Product Security has rated this issue as having Moderate security impact, a future update my address this flaw in Red Hat Enterprise Linux 6 and 7. This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle, https://access.redhat.com/support/policy/updates/errata/
NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.
| Base Score | 3.6 |
|---|---|
| Base Metrics | AV:L/AC:L/Au:N/C:N/I:P/A:P |
| Access Vector | Local |
| Access Complexity | Low |
| Authentication | None |
| Confidentiality Impact | None |
| Integrity Impact | Partial |
| Availability Impact | Partial |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
| Platform | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 7 | dbus | Will not fix |
| Red Hat Enterprise Linux 6 | dbus | Will not fix |
| Red Hat Enterprise Linux 5 | dbus | Will not fix |
Vulmon