CVEvulnerability
CVE-2013-4288
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2013-10-03
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-362
Description
Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.
Affected configurations
• opensuse opensuse 12.2
• opensuse opensuse 12.3
• polkit project polkit (< 0.112.1)
• canonical ubuntu linux 10.04
• canonical ubuntu linux 12.04
• canonical ubuntu linux 12.10
• canonical ubuntu linux 13.04
• redhat enterprise linux 6.0
Related
Weakness · CWE (1)
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
References
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1002375 Issue Tracking, Patch, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00004.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00005.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00062.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-11/msg00000.html Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-1270.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-1460.html Third Party Advisory
- http://seclists.org/oss-sec/2013/q3/626 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/09/18/4 Mailing List, Third Party Advisory
- http://www.ubuntu.com/usn/USN-1953-1 Third Party Advisory
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1002375 Issue Tracking, Patch, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00004.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00005.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-10/msg00062.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-11/msg00000.html Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-1270.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-1460.html Third Party Advisory
- http://seclists.org/oss-sec/2013/q3/626 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/09/18/4 Mailing List, Third Party Advisory
- http://www.ubuntu.com/usn/USN-1953-1 Third Party Advisory