ID de Prueba:	1.3.6.1.4.1.25623.1.1.10.2014.0457
Categoría:	Mageia Linux Local Security Checks
Título:	Mageia: Security Advisory (MGASA-2014-0457)
Resumen:	The remote host is missing an update for the 'dbus' package(s) announced via the MGASA-2014-0457 advisory.
Descripción:	Summary: The remote host is missing an update for the 'dbus' package(s) announced via the MGASA-2014-0457 advisory. Vulnerability Insight: The patch issued by the D-Bus maintainers for CVE-2014-3636 was based on incorrect reasoning, and does not fully prevent the attack described as 'CVE-2014-3636 part A', which is repeated below. Preventing that attack requires raising the system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a higher value. By queuing up the maximum allowed number of fds, a malicious sender could reach the system dbus-daemon's RLIMIT_NOFILE (ulimit -n, typically 1024 on Linux). This would act as a denial of service in two ways: * new clients would be unable to connect to the dbus-daemon * when receiving a subsequent message from a non-malicious client that contained a fd, dbus-daemon would receive the MSG_CTRUNC flag, indicating that the list of fds was truncated, kernel fd-passing APIs do not provide any way to recover from that, so dbus-daemon responds to MSG_CTRUNC by disconnecting the sender, causing denial of service to that sender. This update resolves the issue (CVE-2014-7824). Also default auth_timeout that was changed from 30s to 5s in MGASA-2014-0395, and raised to 20s in MGAA-2014-0182 is now changed back to 30s as there still are reports about failing dbus connections. Affected Software/OS: 'dbus' package(s) on Mageia 3, Mageia 4. Solution: Please install the updated package(s). CVSS Score: 2.1 CVSS Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2014-7824 BugTraq ID: 71012 http://www.securityfocus.com/bid/71012 Debian Security Information: DSA-3099 (Google Search) http://www.debian.org/security/2014/dsa-3099 http://www.mandriva.com/security/advisories?name=MDVSA-2015:176 http://www.openwall.com/lists/oss-security/2014/11/10/2 http://secunia.com/advisories/62603 http://www.ubuntu.com/usn/USN-2425-1 XForce ISS Database: dbus-cve20147824-dos(98576) https://exchange.xforce.ibmcloud.com/vulnerabilities/98576
Copyright	Copyright (C) 2022 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.