CVE-2019-12749

What it actually does

Symlink mishandling in the DBUS_COOKIE_SHA1 authentication mechanism allows a local client with write access to its home directory to redirect a DBusServer (running under a different UID) to read attacker-controlled keyring data, enabling reuse of a known cookie and subsequent authentication bypass.

Why it matters to the business

Attackers on the same system can obtain unauthorized access to inter-process communication channels used by system services, potentially exposing sensitive operations or enabling further local privilege escalation with minimal user interaction.

How an attack unfolds

A local attacker creates a malicious symlink under ~/.dbus-keyrings pointing to a location they control, forces the target DBusServer to load a cookie they already know, then connects using that cookie; the server accepts the connection as originating from the attacker-chosen UID, completing the bypass.

How to fix it

Upgrade dbus to version 1.10.28 or newer, 1.12.16 or newer, or 1.13.12 or newer; the reference implementation contains the fix in commit 983e62be144c3615bd44feb9850dc4ccd797e3b8. Restart all services that embed or link against libdbus after the update.

How to confirm the fix worked

Verify the installed dbus package reports a version at or above the fixed releases, confirm the presence of the symlink-handling changes in the DBUS_COOKIE_SHA1 code path, and test that a non-root user cannot influence keyring paths used by a root-owned DBusServer.

Typical attack path

1. Obtain local shell or process execution under a non-privileged UID
2. Write a crafted symlink in the user's ~/.dbus-keyrings directory
3. Trigger or wait for a connection attempt from the target DBusServer
4. Present the pre-known cookie during the DBUS_COOKIE_SHA1 exchange
5. Gain authenticated access to the DBusServer's message bus

How to detect it

Examine authentication logs from dbus-daemon or Upstart for unexpected UID transitions during COOKIE_SHA1 sessions; review file-system audit trails for symlink creation inside user home directories that coincide with dbus connections from higher-privileged processes.

What your security team should do

• Apply the dbus package update to all affected systems within standard change windows
• Audit local user home directories for unexpected symlinks under .dbus-keyrings
• Review any custom or embedded uses of DBUS_COOKIE_SHA1 authentication and migrate to stronger mechanisms where possible
• Monitor for future dbus releases and include the package in routine vulnerability scanning