Test ID:	1.3.6.1.4.1.25623.1.1.4.2014.1146.1
Category:	SuSE Local Security Checks
Title:	SUSE: Security Advisory (SUSE-SU-2014:1146-1)
Summary:	The remote host is missing an update for the 'dbus-1' package(s) announced via the SUSE-SU-2014:1146-1 advisory.
Description:	Summary: The remote host is missing an update for the 'dbus-1' package(s) announced via the SUSE-SU-2014:1146-1 advisory. Vulnerability Insight: Various denial of service issues were fixed in the DBUS service. * CVE-2014-3638: dbus-daemon tracks whether method call messages expect a reply, so that unsolicited replies can be dropped. As currently implemented, if there are n parallel method calls in progress, each method reply takes O(n) CPU time. A malicious user could exploit this by opening the maximum allowed number of parallel connections and sending the maximum number of parallel method calls on each one, causing subsequent method calls to be unreasonably slow, a denial of service. * CVE-2014-3639: dbus-daemon allows a small number of 'incomplete' connections (64 by default) whose identity has not yet been confirmed. When this limit has been reached, subsequent connections are dropped. Alban's testing indicates that one malicious process that makes repeated connection attempts, but never completes the authentication handshake and instead waits for dbus-daemon to time out and disconnect it, can cause the majority of legitimate connection attempts to fail. Security Issues: * CVE-2014-3638 * CVE-2014-3638 Affected Software/OS: 'dbus-1' package(s) on SUSE Linux Enterprise Desktop 11-SP3, SUSE Linux Enterprise Server 11-SP3, SUSE Linux Enterprise Software Development Kit 11-SP3. Solution: Please install the updated package(s). CVSS Score: 2.1 CVSS Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-3638 1030864 http://www.securitytracker.com/id/1030864 61378 http://secunia.com/advisories/61378 61431 http://secunia.com/advisories/61431 DSA-3026 http://www.debian.org/security/2014/dsa-3026 MDVSA-2015:176 http://www.mandriva.com/security/advisories?name=MDVSA-2015:176 SUSE-SU-2014:1146 http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00026.html USN-2352-1 http://www.ubuntu.com/usn/USN-2352-1 [oss-security] 20140916 CVE-2014-3635 to 3639: security issues in D-Bus < 1.8.8 http://www.openwall.com/lists/oss-security/2014/09/16/9 http://advisories.mageia.org/MGASA-2014-0395.html https://bugs.freedesktop.org/show_bug.cgi?id=81053 openSUSE-SU-2014:1239 http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html Common Vulnerability Exposure (CVE) ID: CVE-2014-3639 https://bugs.freedesktop.org/show_bug.cgi?id=80919
Copyright	Copyright (C) 2021 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.