CVEvulnerability

CVE-2014-3477

4.0 MEDIUM Published 2014-07-01 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-07-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.0 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:N/I:N/A:P

Description

The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.

Affected configurations

• d-bus project d-bus 1.2.4.2 • d-bus project d-bus 1.2.4.4 • d-bus project d-bus 1.2.4.6 • freedesktop dbus 1.2.1 • freedesktop dbus 1.2.3 • freedesktop dbus 1.2.4 • freedesktop dbus 1.2.6 • freedesktop dbus 1.2.8 • freedesktop dbus 1.2.10 • freedesktop dbus 1.2.12 • freedesktop dbus 1.2.14 • freedesktop dbus 1.2.16 • freedesktop dbus 1.2.18 • freedesktop dbus 1.2.20 • freedesktop dbus 1.2.22 • freedesktop dbus 1.2.24 • freedesktop dbus 1.2.26 • freedesktop dbus 1.2.28 • freedesktop dbus 1.2.30 • freedesktop dbus 1.3.0 • freedesktop dbus 1.3.1 • freedesktop dbus 1.4.0 • freedesktop dbus 1.4.1 • freedesktop dbus 1.4.4 • freedesktop dbus 1.4.6 • freedesktop dbus 1.4.8 • freedesktop dbus 1.4.10 • freedesktop dbus 1.4.12 • freedesktop dbus 1.4.14 • freedesktop dbus 1.4.16 • freedesktop dbus 1.4.18 • freedesktop dbus 1.4.20 • freedesktop dbus 1.4.22 • freedesktop dbus 1.4.24 • freedesktop dbus 1.4.26 • freedesktop dbus 1.6.0 • freedesktop dbus 1.6.2 • freedesktop dbus 1.6.4 • freedesktop dbus 1.6.6 • freedesktop dbus 1.6.8 • freedesktop dbus 1.6.10 • freedesktop dbus 1.6.12 • freedesktop dbus 1.6.14 • freedesktop dbus 1.6.16 • freedesktop dbus 1.6.18 • freedesktop dbus 1.8.0 • freedesktop dbus 1.8.2

References