According to the versions of the dbus packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202305-08 (D-Bus: Multiple Vulnerabilities)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5704-1 advisory.

    It was discovered that DBus incorrectly handled messages with invalid type signatures. A local attacker     could possibly use this issue to cause DBus to crash, resulting in a denial of service. (CVE-2022-42010)

    It was discovered that DBus was incorrectly validating the length of arrays of fixed-length items. A local     attacker could possibly use this issue to cause DBus to crash, resulting in a denial of service.
    (CVE-2022-42011)

    It was discovered that DBus incorrectly handled the body DBus message with attached file descriptors. A     local attacker could possibly use this issue to cause DBus to crash, resulting in a denial of service.
    (CVE-2022-42012)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3142 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3142-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     October 10, 2022                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : dbus     Version        : 1.12.24-0+deb10u1     CVE ID         : CVE-2022-42010 CVE-2022-42011 CVE-2022-42012

    Evgeny Vereshchagin discovered multiple vulnerabilities in D-Bus, a     simple interprocess messaging system, which may result in denial of     service by an authenticated user.

    For Debian 10 buster, these problems have been fixed in version     1.12.24-0+deb10u1.

    We recommend that you upgrade your dbus packages.

    For the detailed security status of dbus please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/dbus

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-7a963a79d1 advisory.

    Update to 1.12.24

    * Fix CVE-2022-42010, CVE-2022-42011, CVE-2022-42012

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0096 advisory.

    D-Bus is a system for sending messages between applications. It is used both for the system-wide message     bus service, and as a per-user-login-session messaging facility.

    Security Fix(es):

    * dbus: dbus-daemon crashes when receiving message with incorrectly nested parentheses and curly brackets     (CVE-2022-42010)

    * dbus: dbus-daemon can be crashed by messages with array length inconsistent with element type     (CVE-2022-42011)

    * dbus: `_dbus_marshal_byteswap` doesn't process fds in messages with foreign endianness correctly     (CVE-2022-42012)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of dbus installed on the remote host is prior to 1.10.24-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2006 advisory.

    An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

    An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

    An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3806-1 advisory.

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message with certain invalid type signatures. (CVE-2022-42010)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when     receiving a message where an array length is inconsistent with the size of the element type.
    (CVE-2022-42011)

  - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before     1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by     sending a message with attached file descriptors in an unexpected format. (CVE-2022-42012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
169662	EulerOS 2.0 SP9 : dbus (EulerOS-SA-2023-1096)	Nessus	Huawei Local Security Checks	2023/1/6	2023/9/11	medium
169535	EulerOS 2.0 SP11 : dbus (EulerOS-SA-2023-1006)	Nessus	Huawei Local Security Checks	2023/1/5	2023/9/11	medium
175037	GLSA-202305-08 : D-Bus: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2023/5/3	2023/5/3	medium
166619	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : DBus vulnerabilities (USN-5704-1)	Nessus	Ubuntu Local Security Checks	2022/10/27	2024/8/29	medium
165983	Debian dla-3142 : dbus - security update	Nessus	Debian Local Security Checks	2022/10/10	2025/1/22	medium
169191	Fedora 35 : dbus (2022-7a963a79d1)	Nessus	Fedora Local Security Checks	2022/12/23	2024/11/14	medium
169967	RHEL 8 : dbus (RHSA-2023:0096)	Nessus	Red Hat Local Security Checks	2023/1/12	2024/11/7	medium
173909	Amazon Linux 2 : dbus (ALAS-2023-2006)	Nessus	Amazon Linux Local Security Checks	2023/4/5	2024/12/11	medium
166687	SUSE SLED15 / SLES15 Security Update : dbus-1 (SUSE-SU-2022:3806-1)	Nessus	SuSE Local Security Checks	2022/10/28	2023/7/13	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium

medium