Race condition

systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...

CVE-2013-4324

spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkitunixprocessnew API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process...

Race condition

apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2...

CVE-2013-1063

CVE-2013-1063 affects usb-creator versions before 0.2.47.1 and earlier Ubuntu builds (0.2.40ubuntu2, 0.2.38.2). The flaw arises from improper D-Bus communication with a Polkit authority, enabling local users to bypass access restrictions via a PolkitUnixProcess PolkitSubject race conditioned by a...

CVE-2013-1064

apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2...

CVE-2013-4326

MiracleLinux 4 advisories reference CVE-2013-4326 in rtkit-0.5-2.AXS4, describing a Polkit-related race condition that allows local bypass of access restrictions via PolkitUnixProcess with setuid or pkexec. The linked Nessus notes (AXSA:2013-629:01) and (AXSA:2013-630:01) indicate affected packag...

CVE-2013-4327

CVE-2013-4327 describes a Polkit race condition used when systemd communicates with a polkit authority via D-Bus, enabling local users to bypass access restrictions using a PolkitUnixProcess PolkitSubject race with (1) setuid processes or (2) pkexec. Connected advisories (GLSA-201406-27, related ...

CVE-2013-4311

CVE-2013-4311 stems from a PolkitUnixProcess race in pkcheck that can bypass access controls via a (setuid) process or pkexec, enabling local privilege bypass. Affected are libvirt components across multiple branches: libvirt 1.0.5.x (before 1.0.5.6), 0.10.2.x (before 0.10.2.8), and 0.9.12.x (bef...

CVE-2013-4288

Polkit (PolicyKit) contains a race condition that can allow a local user to bypass authorization by starting a setuid or pkexec process before the polkit authorization check completes. The issue centers on the PolkitUnixProcess race (including polkit_unix_process_new API usage) and is related to ...

CVE-2013-4327

systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...

CVE-2013-1065

CVE-2013-1065 : backend.py in Jockey prior to 0.9.7-0ubuntu7.11 does not properly use D-Bus for polkit communication, enabling local bypass of access restrictions via a PolkitUnixProcess PolkitSubject race (noted as related to CVE-2013-4288). Impact is a local privilege bypass with by-passing pol...

CVE-2013-4327

systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a 1 setuid process or 2 pkexec process, a related issue to CVE-2013-4288...

Mandriva Linux Security Advisory : polkit (MDVSA-2013:243)

Updated polkit packages fix security vulnerability : A race condition was found in the way the PolicyKit pkcheck utility checked process authorization when the process was specified by its process ID via the --process option. A local user could use this flaw to bypass intended PolicyKit...

CentOS Update for polkit CESA-2013:1270 centos6

Check for the Version of polkit OpenVAS Vulnerability Test CentOS Update for polkit CESA-2013:1270 centos6 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under th...

CentOS Update for polkit CESA-2013:1270 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for polkit FEDORA-2013-17197

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RedHat Update for polkit RHSA-2013:1270-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 20 : polkit-0.112-1.fc20 (2013-17160)

This release fixes CVE-2013-4288: Race condition with process subjects that do not have securely determined uid. pkcheck1 now supports a new format for the --process argument; all applications need to use the new format to avoid a race condition or use --system-bus-name to identify the process...

Fedora 18 : polkit-0.107-6.fc18 (2013-17197)

This release fixes CVE-2013-4288: Race condition with process subjects that do not have securely determined uid. pkcheck1 now supports a new format for the --process argument; all applications need to use the new format to avoid a race condition or use --system-bus-name to identify the process...

Fedora 19 : polkit-0.112-1.fc19 (2013-17191)

This release fixes CVE-2013-4288: Race condition with process subjects that do not have securely determined uid. pkcheck1 now supports a new format for the --process argument; all applications need to use the new format to avoid a race condition or use --system-bus-name to identify the process...