CVE-2005-0201 Missing authorization in n/a

Low 2.1 Published 28 Jun 2005 Updated 7 Aug 2024

Local attackers can intercept or inject messages on other users' session buses due to improper socket access restrictions in D-Bus.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2005-0201?

CVE-2005-0201 is a low-severity missing authorization vulnerability in n/a, published on 28 Jun 2005. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

D-BUS (dbus) before 0.22 does not properly restrict access to a socket, if the socket address is known, which allows local users to listen or send arbitrary messages on another user's per-user session bus via that socket.

Which versions are affected by CVE-2005-0201?

It affects 1 product.

Linux distribution packages (24)

`dbus` Red Hat:enterprise_linux:4::as	All versions	`0:0.22-12.EL.2`
`dbus-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`0:0.22-12.EL.2`
`dbus-devel` Red Hat:enterprise_linux:4::as	All versions	`0:0.22-12.EL.2`
`dbus-glib` Red Hat:enterprise_linux:4::as	All versions	`0:0.22-12.EL.2`
`dbus-python` Red Hat:enterprise_linux:4::as	All versions	`0:0.22-12.EL.2`
`dbus-x11` Red Hat:enterprise_linux:4::as	All versions	`0:0.22-12.EL.2`
`dbus` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.22-12.EL.2`
`dbus-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.22-12.EL.2`
`dbus-devel` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.22-12.EL.2`
`dbus-glib` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.22-12.EL.2`
`dbus-python` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.22-12.EL.2`
`dbus-x11` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.22-12.EL.2`
`dbus` Red Hat:enterprise_linux:4::es	All versions	`0:0.22-12.EL.2`
`dbus-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`0:0.22-12.EL.2`
`dbus-devel` Red Hat:enterprise_linux:4::es	All versions	`0:0.22-12.EL.2`
`dbus-glib` Red Hat:enterprise_linux:4::es	All versions	`0:0.22-12.EL.2`
`dbus-python` Red Hat:enterprise_linux:4::es	All versions	`0:0.22-12.EL.2`
`dbus-x11` Red Hat:enterprise_linux:4::es	All versions	`0:0.22-12.EL.2`
`dbus` Red Hat:enterprise_linux:4::ws	All versions	`0:0.22-12.EL.2`
`dbus-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`0:0.22-12.EL.2`
`dbus-devel` Red Hat:enterprise_linux:4::ws	All versions	`0:0.22-12.EL.2`
`dbus-glib` Red Hat:enterprise_linux:4::ws	All versions	`0:0.22-12.EL.2`
`dbus-python` Red Hat:enterprise_linux:4::ws	All versions	`0:0.22-12.EL.2`
`dbus-x11` Red Hat:enterprise_linux:4::ws	All versions	`0:0.22-12.EL.2`

Products include D-Bus D-Bus.

How do I fix CVE-2005-0201?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2005-0201 being exploited?

There is no known exploitation of CVE-2005-0201 in the wild and no public exploit code.

CVE-2006-6107 Missing authorization in n/a Low 1.7

Sources

Also known as DEBIAN-CVE-2005-0201, GHSA-42r7-php7-668w, RHSA-2005:102.