Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2008-4311

Quick assessment

Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Red Hat D-BUS（也称DBus）是美国红帽（Red Hat）公司的一个免费的消息总线模块，它提供了简单应用程序互相通讯的途径，是freedesktop.org项目的一部分。 D-BUS的默认配置错误的设置了send_requested_reply和receive_requested_reply规则，这可能允许发送和接收本应阻断的消息。 D-BUS的默认配置中包含有以下行： 这些规则的初衷是无需明确许可便允许发送所有的回复，但实际的情况是：当认为要发送消息时，首先要进入policy.c中的bus_

AI Predicted 3.3 Difficulty: Easy EPSS 0.41% · P34

Possible ATT&CK Techniques 2 AI

T1548.001 · Setuid and Setgid T1562.008
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2008-4311

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The default configuration of system.conf in D-Bus (aka DBus) before 1.2.6 omits the send_type attribute in certain rules, which allows local users to bypass intended access restrictions by (1) sending messages, related to send_requested_reply; and possibly (2) receiving messages, related to receive_requested_reply.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
D-Bus 规则绕过安全限制漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat D-BUS（也称DBus）是美国红帽（Red Hat）公司的一个免费的消息总线模块，它提供了简单应用程序互相通讯的途径，是freedesktop.org项目的一部分。 D-BUS的默认配置错误的设置了send_requested_reply和receive_requested_reply规则，这可能允许发送和接收本应阻断的消息。 D-BUS的默认配置中包含有以下行： 这些规则的初衷是无需明确许可便允许发送所有的回复，但实际的情况是：当认为要发送消息时，首先要进入policy.c中的bus_
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2008-4311

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2008-4311

请登录查看更多情报信息。

Vendor Advisories for CVE-2008-4311 (9)

Mailing List Discussions for CVE-2008-4311 (5)

Other References for CVE-2008-4311 (3)

Same Patch Batch · n/a · 2008-12-10 · 41 CVEs total

CVE-2008-5418 PUNBB PunPortal login.php目录遍历漏洞
CVE-2008-4264 Microsoft Excel畸形公式解析远程代码执行漏洞
CVE-2008-4265 Microsoft Excel畸形对象解析远程代码执行漏洞
CVE-2008-4266 Microsoft Excel数组内存破坏漏洞
CVE-2008-4268 Microsoft Windows保存搜索文件处理内存破坏漏洞
CVE-2008-4269 Microsoft Windows search-ms协议解析远程代码执行漏洞
CVE-2008-4837 Microsoft Word畸形对象解析多个缓冲区溢出和内存破坏漏洞
CVE-2008-4841 Microsoft写字板文件转换器远程代码执行漏洞
CVE-2008-5416 Microsoft SQL Server sp_replwritetovarbin远程堆溢出漏洞
CVE-2008-5417 HP DECnet-Plus OpenVMS 'OSIT$NAMES'权限许可和访问控制漏洞
CVE-2008-4261 Microsoft IE HTML渲染内存破坏漏洞
CVE-2008-5419 EMC ControlCenter SAN Manager SST_CTGTRANS远程栈溢出漏洞
CVE-2008-5420 EMC ControlCenter SAN Manager SST_SENDFILE远程文件检索漏洞
CVE-2008-5304 TWiki URLPARAM变量跨站脚本漏洞
CVE-2008-5305 TWiki SEARCH变量SHELL命令注入漏洞
CVE-2008-5410 Sun Solaris OpenSSL 'PKCS#11' Engine 远程拒绝服务漏洞
CVE-2008-5411 IBM WebSphere应用程序服务器网络敏感信息泄露漏洞
CVE-2008-5412 IBM WebSphere Windows上的JSPs未明漏洞
CVE-2008-5413 IBM WebSphere PerfServlet信息泄露漏洞
CVE-2008-5414 IBM WebSphere Feature Pack未明漏洞

Showing top 20 of 41 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2008-4311

No comments yet

Leave a comment