CVE-2013-4288

2013-10-0321:55:00

CWE-362

[email protected]

web.nvd.nist.gov

cve

2013-4288

race condition

policykit

polkit

privileges

setuid

pkexec

authorization

nvd

6.1 Medium

AI Score

Confidence

Low

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.3%

JSON

Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.

CPENameOperatorVersion
opensuse:opensuseopensuseeq12.3
opensuse:opensuseopensuseeq12.2
polkit_project:polkitpolkit project polkitlt0.112.1
canonical:ubuntu_linuxcanonical ubuntu linuxeq13.04
redhat:enterprise_linuxredhat enterprise linuxeq6.0
canonical:ubuntu_linuxcanonical ubuntu linuxeq12.10
canonical:ubuntu_linuxcanonical ubuntu linuxeq12.04
canonical:ubuntu_linuxcanonical ubuntu linuxeq10.04

CPE	Name	Operator	Version
opensuse:opensuse	opensuse	eq	12.3
opensuse:opensuse	opensuse	eq	12.2
polkit_project:polkit	polkit project polkit	lt	0.112.1
canonical:ubuntu_linux	canonical ubuntu linux	eq	13.04
redhat:enterprise_linux	redhat enterprise linux	eq	6.0
canonical:ubuntu_linux	canonical ubuntu linux	eq	12.10
canonical:ubuntu_linux	canonical ubuntu linux	eq	12.04
canonical:ubuntu_linux	canonical ubuntu linux	eq	10.04