CVE-2006-6107 Missing authorization in n/a

Low 1.7 Published 14 Dec 2006 Updated 7 Aug 2024

Local applications can remove match rules for other applications in D-Bus, causing a denial of service by losing process messages.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2006-6107?

CVE-2006-6107 is a low-severity missing authorization vulnerability in n/a, published on 14 Dec 2006. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service (lost process messages).

Which versions are affected by CVE-2006-6107?

It affects 1 product.

Linux distribution packages (24)

`dbus` Red Hat:enterprise_linux:4::as	All versions	`0:0.22-12.EL.8`
`dbus-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`0:0.22-12.EL.8`
`dbus-devel` Red Hat:enterprise_linux:4::as	All versions	`0:0.22-12.EL.8`
`dbus-glib` Red Hat:enterprise_linux:4::as	All versions	`0:0.22-12.EL.8`
`dbus-python` Red Hat:enterprise_linux:4::as	All versions	`0:0.22-12.EL.8`
`dbus-x11` Red Hat:enterprise_linux:4::as	All versions	`0:0.22-12.EL.8`
`dbus` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.22-12.EL.8`
`dbus-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.22-12.EL.8`
`dbus-devel` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.22-12.EL.8`
`dbus-glib` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.22-12.EL.8`
`dbus-python` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.22-12.EL.8`
`dbus-x11` Red Hat:enterprise_linux:4::desktop	All versions	`0:0.22-12.EL.8`
`dbus` Red Hat:enterprise_linux:4::es	All versions	`0:0.22-12.EL.8`
`dbus-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`0:0.22-12.EL.8`
`dbus-devel` Red Hat:enterprise_linux:4::es	All versions	`0:0.22-12.EL.8`
`dbus-glib` Red Hat:enterprise_linux:4::es	All versions	`0:0.22-12.EL.8`
`dbus-python` Red Hat:enterprise_linux:4::es	All versions	`0:0.22-12.EL.8`
`dbus-x11` Red Hat:enterprise_linux:4::es	All versions	`0:0.22-12.EL.8`
`dbus` Red Hat:enterprise_linux:4::ws	All versions	`0:0.22-12.EL.8`
`dbus-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`0:0.22-12.EL.8`
`dbus-devel` Red Hat:enterprise_linux:4::ws	All versions	`0:0.22-12.EL.8`
`dbus-glib` Red Hat:enterprise_linux:4::ws	All versions	`0:0.22-12.EL.8`
`dbus-python` Red Hat:enterprise_linux:4::ws	All versions	`0:0.22-12.EL.8`
`dbus-x11` Red Hat:enterprise_linux:4::ws	All versions	`0:0.22-12.EL.8`

Products include D-Bus D-Bus.

How do I fix CVE-2006-6107?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2006-6107 being exploited?

There is no known exploitation of CVE-2006-6107 in the wild and no public exploit code.

CVE-2005-0201 Missing authorization in n/a Low 2.1

Sources

Also known as DEBIAN-CVE-2006-6107, GHSA-r8m2-5wq2-xvh3, RHSA-2007:0008.