NVD Vulnerability Detail

CVE-2014-8156

Summary	The D-Bus security policy files in /etc/dbus-1/system.d/*.conf in fso-gsmd 0.12.0-3, fso-frameworkd 0.9.5.9+git20110512-4, and fso-usaged 0.12.0-2 as packaged in Debian, the upstream cornucopia.git (fsoaudiod, fsodatad, fsodeviced, fsogsmd, fsonetworkd, fsotdld, fsousaged) git master on 2015-01-19, the upstream framework.git 0.10.1 and git master on 2015-01-19, phonefsod 0.1+git20121018-1 as packaged in Debian, Ubuntu and potentially other packages, and potentially other fso modules do not properly filter D-Bus message paths, which might allow local users to cause a denial of service (dbus-daemon memory consumption), or execute arbitrary code as root by sending a crafted D-Bus message to any D-Bus system service.
Publication Date	Sept. 26, 2017, 10:29 a.m.
Registration Date	Jan. 26, 2021, 3:20 p.m.
Last Update	Nov. 21, 2024, 11:18 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:fso-frameworkd_project:fso-frameworkd:0.9.5.9:::::::*
cpe:2.3:a:fso-gsmd_project:fso-gsmd:0.12.0-3:::::::*
cpe:2.3:a:fso-usaged_project:fso-usaged:0.12.0-2:::::::*
cpe:2.3:a:phonefsod_project:phonefsod:0.1:::::::*
execution environment
1	cpe:2.3:o:debian:debian_linux::::::::

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2015/01/27/25	Mailing List Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2015/01/27/25	Mailing List Third Party Advisory
3	http://www.securityfocus.com/bid/72363	Third Party Advisory VDB Entry
4	http://www.securityfocus.com/bid/72363	Third Party Advisory VDB Entry
5	https://exchange.xforce.ibmcloud.com/vulnerabilities/100488	Third Party Advisory VDB Entry
6	https://exchange.xforce.ibmcloud.com/vulnerabilities/100488	Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

複数の fso 製品および phonefsod における認可・権限・アクセス制御に関する脆弱性

Title	複数の fso 製品および phonefsod における認可・権限・アクセス制御に関する脆弱性
Summary	複数の fso 製品および phonefsod には、認可・権限・アクセス制御に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Oct. 10, 2014, midnight
Registration Date	Oct. 25, 2017, 6:10 p.m.
Last Update	Oct. 25, 2017, 6:10 p.m.

Affected System

freesmartphone.org

fso-frameworkd

fso-gsmd

fso-usaged

phonefsod project

phonefsod

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-8156	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8156
National Vulnerability Database (NVD)
2	CVE-2014-8156	https://nvd.nist.gov/vuln/detail/CVE-2014-8156
関連文書
3	CVE-2014-8156: freesmartphone.org stack configures D-Bus system bus to be insecure	http://www.openwall.com/lists/oss-security/2015/01/27/25

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
freesmartphone.org
1	Top Page	http://www.freesmartphone.org/

Change Log

No	Changed Details	Date of change
0	[2017年10月25日] 掲載	Feb. 17, 2018, 10:37 a.m.