Race condition

2013-10-0321:55:00

PRIOn knowledge base

www.prio-n.com

6.2 Medium

AI Score

Confidence

High

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.4%

JSON

apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

CPENameOperatorVersion
apt-xapian-indexeq0.44.0-ubuntu5.1
apt-xapian-indexeq0.44.0-ubuntu7.1
apt-xapian-indexeq>= 0.45ubuntu1 AND < 0.45ubuntu2.1
ubuntu_linuxeq13.04
ubuntu_linuxeq12.04
ubuntu_linuxeq12.10

Name	Operator	Version
apt-xapian-index	eq	0.44.0-ubuntu5.1
apt-xapian-index	eq	0.44.0-ubuntu7.1
apt-xapian-index	eq	>= 0.45ubuntu1 AND < 0.45ubuntu2.1
ubuntu_linux	eq	13.04
ubuntu_linux	eq	12.04
ubuntu_linux	eq	12.10