CVE-2012-3524
Quick assessment
Affected
n/a n/a
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
libdbus是Freedesktop的一个低级库，旨在成为语言绑定的后端，并且需要额外的复杂性来实现 dbus-daemon。 libdbus 存在权限许可和访问控制问题漏洞。本地攻击者可利用该漏洞通过DBUS_SYSTEM_BUS_ADDRESS环境变量获取特权并执行任意代码。
Public Exploits 1
ExploitDB · 1
EDB-21323#CVE-2012-3524 [local]
Possible ATT&CK Techniques 1 AI
T1548 · Abuse Elevation Control Mechanism
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2012-3524
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable. NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
libdbus 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
libdbus是Freedesktop的一个低级库，旨在成为语言绑定的后端，并且需要额外的复杂性来实现 dbus-daemon。 libdbus 存在权限许可和访问控制问题漏洞。本地攻击者可利用该漏洞通过DBUS_SYSTEM_BUS_ADDRESS环境变量获取特权并执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2012-3524
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2012-3524
请登录查看更多情报信息。
Vendor Advisories for CVE-2012-3524 (10)
-
https://bugzilla.redhat.com/show_bug.cgi?id=847402 x_refsource_MISC
-
-
-
-
-
🔗 USN-1576-2: DBus regressions | Ubuntu security notices | Ubuntu Read full article vendor-advisory x_refsource_UBUNTU
-
-
http://www.mandriva.com/security/advisories?name=MDVSA-2013:083 vendor-advisory x_refsource_MANDRIVA
-
-
http://www.mandriva.com/security/advisories?name=MDVSA-2013:070 vendor-advisory x_refsource_MANDRIVA
Exploits & Public PoCs for CVE-2012-3524 (1)
Mailing List Discussions for CVE-2012-3524 (9)
-
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00009.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00015.html vendor-advisory x_refsource_SUSE
-
-
http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00000.html vendor-advisory x_refsource_SUSE
-
-
-
-
-
Other References for CVE-2012-3524 (2)
-
http://stealth.openwall.net/null/dzug.c x_refsource_MISC
-
https://bugs.freedesktop.org/show_bug.cgi?id=52202 x_refsource_CONFIRM
Same Patch Batch · n/a · 2012-09-18 · 24 CVEs total
| CVE-2012-3547 | FreeRADIUS 多个基于栈的缓冲区溢出漏洞 | |
| CVE-2012-2994 | CoSoSys Endpoint Protector 可预测密码生成漏洞 | |
| CVE-2012-2993 | Microsoft Windows Phone 7 加密问题漏洞 | |
| CVE-2012-4969 | Microsoft Internet Explorer ‘CMshtmlEd::Exec’函数释放后使用漏洞 | |
| CVE-2012-3034 | Siemens SIMATIC WinCC 信息泄露漏洞 | |
| CVE-2012-3032 | Siemens SIMATIC WinCC SQL注入漏洞 | |
| CVE-2012-3031 | Siemens SIMATIC WinCC 多个跨站脚本漏洞 | |
| CVE-2012-3030 | Siemens SIMATIC WinCC 权限许可和访问控制漏洞 | |
| CVE-2012-3028 | Siemens SIMATIC WinCC 跨站请求伪造漏洞 | |
| CVE-2012-4425 | libgio 权限许可和访问控制问题漏洞 | |
| CVE-2012-4413 | OpenStack Keystone 权限许可和访问控制问题漏洞 | |
| CVE-2012-4405 | Artifex Software Ghostscript 数字错误漏洞 | |
| CVE-2012-1654 | Drupal ‘Data’模块跨站脚本漏洞 | |
| CVE-2012-1901 | FlexCMS 多个跨站请求伪造漏洞 | |
| CVE-2012-1184 | Asterisk 缓冲区溢出漏洞 | |
| CVE-2012-1183 | Asterisk 远程拒绝服务漏洞 | |
| CVE-2011-4941 | Piwik 任意代码执行漏洞 | |
| CVE-2012-1660 | Drupal ‘Webform’模块多个跨站脚本漏洞 | |
| CVE-2012-1659 | Drupal ‘Node Recommendation’模块跨站脚本漏洞 | |
| CVE-2012-1658 | Drupal ‘Read More Link’模块跨站脚本漏洞 |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2012-3524
No comments yet