CVE-2009-1189 Other in n/a

Low 3.6 Published 27 Apr 2009 Updated 7 Aug 2024

Remote attackers can spoof signatures in D-Bus due to incorrect validation logic, bypassing security checks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2009-1189?

CVE-2009-1189 is a low-severity vulnerability in n/a, published on 27 Apr 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The _dbus_validate_signature_with_reason function (dbus-marshal-validate.c) in D-Bus (aka DBus) before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834.

Weakness: CWE-20

Which versions are affected by CVE-2009-1189?

It affects 1 product.

Linux distribution packages (12)

`dbus` Red Hat:enterprise_linux:5::client	All versions	`0:1.1.2-12.el5_4.1`
`dbus-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:1.1.2-12.el5_4.1`
`dbus-libs` Red Hat:enterprise_linux:5::client	All versions	`0:1.1.2-12.el5_4.1`
`dbus-x11` Red Hat:enterprise_linux:5::client	All versions	`0:1.1.2-12.el5_4.1`
`dbus` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.1.2-12.el5_4.1`
`dbus-debuginfo` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.1.2-12.el5_4.1`
`dbus-devel` Red Hat:enterprise_linux:5::client_workstation	All versions	`0:1.1.2-12.el5_4.1`
`dbus` Red Hat:enterprise_linux:5::server	All versions	`0:1.1.2-12.el5_4.1`
`dbus-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:1.1.2-12.el5_4.1`
`dbus-devel` Red Hat:enterprise_linux:5::server	All versions	`0:1.1.2-12.el5_4.1`
`dbus-libs` Red Hat:enterprise_linux:5::server	All versions	`0:1.1.2-12.el5_4.1`
`dbus-x11` Red Hat:enterprise_linux:5::server	All versions	`0:1.1.2-12.el5_4.1`

Products include Freedesktop Dbus.

How do I fix CVE-2009-1189?

Upgrade to a fixed version.

Is CVE-2009-1189 being exploited?

There is no known exploitation of CVE-2009-1189 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2009-1189, DSA-1837-1, GHSA-2332-hcww-wjmr, RHSA-2010:0018.