CVE-2013-2168 Denial of service in n/a

Low 1.9 Published 3 Jul 2013 Updated 6 Aug 2024

Local attackers can crash the D-Bus service by sending a crafted message, causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2013-2168?

CVE-2013-2168 is a low-severity denial of service vulnerability in Opensuse Opensuse, published on 3 Jul 2013. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.

Weakness: CWE-20

Which versions are affected by CVE-2013-2168?

It affects 2 products.

Products include Freedesktop Dbus, Opensuse Opensuse.

How do I fix CVE-2013-2168?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2013-2168 being exploited?

There is no known exploitation of CVE-2013-2168 in the wild and no public exploit code.

All Opensuse Opensuse vulnerabilities

Sources

Also known as DEBIAN-CVE-2013-2168, DSA-2707-1, GHSA-c26p-366m-4xv6, MGASA-2013-0173.