|
dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.
Original Source: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0595
Learn more about CVE-2008-0595 (Fedora, Enterprise Linux Desktop Workstation, Mandrake Linux, Inter-Process Commu...) |
