ID de Prueba:	1.3.6.1.4.1.25623.1.0.850764
Categoría:	SuSE Local Security Checks
Título:	SUSE: Security Advisory for dbus-1 (SUSE-SU-2014:1146-1)
Resumen:	The remote host is missing an update for the 'dbus-1'; package(s) announced via the referenced advisory.
Descripción:	Summary: The remote host is missing an update for the 'dbus-1' package(s) announced via the referenced advisory. Vulnerability Insight: Various denial of service issues were fixed in the DBUS service. * CVE-2014-3638: dbus-daemon tracks whether method call messages expect a reply, so that unsolicited replies can be dropped. As currently implemented, if there are n parallel method calls in progress, each method reply takes O(n) CPU time. A malicious user could exploit this by opening the maximum allowed number of parallel connections and sending the maximum number of parallel method calls on each one, causing subsequent method calls to be unreasonably slow, a denial of service. * CVE-2014-3639: dbus-daemon allows a small number of 'incomplete' connections (64 by default) whose identity has not yet been confirmed. When this limit has been reached, subsequent connections are dropped. Alban's testing indicates that one malicious process that makes repeated connection attempts, but never completes the authentication handshake and instead waits for dbus-daemon to time out and disconnect it, can cause the majority of legitimate connection attempts to fail. Affected Software/OS: dbus-1 on SUSE Linux Enterprise Server 11 SP3 Solution: Please install the updated package(s). CVSS Score: 2.1 CVSS Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2014-3638 Debian Security Information: DSA-3026 (Google Search) http://www.debian.org/security/2014/dsa-3026 http://www.mandriva.com/security/advisories?name=MDVSA-2015:176 http://www.openwall.com/lists/oss-security/2014/09/16/9 http://www.securitytracker.com/id/1030864 http://secunia.com/advisories/61378 http://secunia.com/advisories/61431 SuSE Security Announcement: SUSE-SU-2014:1146 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00026.html SuSE Security Announcement: openSUSE-SU-2014:1239 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html http://www.ubuntu.com/usn/USN-2352-1 Common Vulnerability Exposure (CVE) ID: CVE-2014-3639
Copyright	Copyright (C) 2015 Greenbone Networks GmbH

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.