CVE-2013-0292 Privilege escalation in n/a

High 7.2 Published 4 Mar 2013 Updated 6 Aug 2024

Local attackers can escalate privileges by spoofing NameOwnerChanged signals in the D-Bus GLib library due to improper sender verification.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2013-0292?

CVE-2013-0292 is a high-severity vulnerability in n/a, published on 4 Mar 2013. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal.

Weakness: CWE-20

Which versions are affected by CVE-2013-0292?

It affects 1 product.

Linux distribution packages (15)

`dbus-glib` Red Hat:enterprise_linux:5::server	All versions	`0:0.73-11.el5_9`
`dbus-glib-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:0.73-11.el5_9`
`dbus-glib-devel` Red Hat:enterprise_linux:5::server	All versions	`0:0.73-11.el5_9`
`dbus-glib` Red Hat:enterprise_linux:6::client	All versions	`0:0.86-6.el6_4`
`dbus-glib-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:0.86-6.el6_4`
`dbus-glib-devel` Red Hat:enterprise_linux:6::client	All versions	`0:0.86-6.el6_4`
`dbus-glib` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.86-6.el6_4`
`dbus-glib-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.86-6.el6_4`
`dbus-glib-devel` Red Hat:enterprise_linux:6::computenode	All versions	`0:0.86-6.el6_4`
`dbus-glib` Red Hat:enterprise_linux:6::server	All versions	`0:0.86-6.el6_4`
`dbus-glib-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:0.86-6.el6_4`
`dbus-glib-devel` Red Hat:enterprise_linux:6::server	All versions	`0:0.86-6.el6_4`
`dbus-glib` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.86-6.el6_4`
`dbus-glib-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.86-6.el6_4`
`dbus-glib-devel` Red Hat:enterprise_linux:6::workstation	All versions	`0:0.86-6.el6_4`

Products include Freedesktop Dbus-Glib.

How do I fix CVE-2013-0292?

Upgrade to a fixed version.

Is CVE-2013-0292 being exploited?

There is no known exploitation of CVE-2013-0292 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

CVE-2010-1172 Security feature bypass in n/a Low 3.6

Sources

Also known as DEBIAN-CVE-2013-0292, GHSA-rw79-5p9f-842m, RHSA-2013:0568.