Linux pkexec / polkitd 0.96 Race Condition

!/bin/sh pid; if stat procbuf, &statbuf != 0 gseterror error, POLKITERROR, POLKITERRORFAILED, "stat failed for /proc/%d: %s", process-pid, gstrerror errno; goto out; where the code only rely on stat of the pseudo filesystem src/polkit/polkitsubject.c --------- there's not enough validation to run...

linux local privilege escalation on polkit-1 <= 0.101

No description provided by source. / polkit-pwnage.c ============================== = PolicyKit Pwnage = = by zx2c4 = = Sept 2, 2011 = ============================== Howdy folks, This exploits CVE-2011-1485, a race condition in PolicyKit. davidz25 explains: --begin-- Briefly, the problem is that...

PolicyKit polkit-1 < 0.101 - Local Privilege Escalation

/ polkit-pwnage.c ============================== = PolicyKit Pwnage = = by zx2c4 = = Sept 2, 2011 = ============================== Howdy folks, This exploits CVE-2011-1485, a race condition in PolicyKit. davidz25 explains: --begin-- Briefly, the problem is that the UID for the parent process of...

CVE-2011-1485

Race condition in the pkexec utility and polkitd daemon in PolicyKit aka polkit 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID...

Immunity Canvas: CVE_2011_1485

Name| CVE20111485 ---|--- CVE| CVE-2011-1485 Exploit Pack| CANVAS Description| CVE-2011-1485: pkexec stuid race Notes| CVE Name: CVE-2011-1485 VENDOR: PolKit Notes: Tested on Red Hat Enterprise Linux 6 Repeatability: Infinite CVE Url: https://vulners.com/cve/CVE-2011-1485 NOTES:...

CVE-2011-1485

CVE-2011-1485 is a race-condition vulnerability in PolicyKit’s pkexec and polkitd that lets a local user escalate privileges by exploiting the mismatch between real and effective UIDs when a setuid binary (e.g., /usr/bin/chsh) is involved in the parent process of pkexec. The root cause is the pke...

CVE-2011-1709

GNOME Display Manager gdm before 2.32.2, when glib 2.28 is used, enables execution of a web browser with the uid of the gdm account, which allows local users to gain privileges via vectors involving the x-scheme-handler/http MIME type...

Slackware 13.1 / current : polkit (SSA:2011-109-01)

New polkit packages are available for Slackware 13.1 and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2011-109-01. The text itself is copyright C...

Mandriva Update for polkit MDVSA-2011:086 (polkit)

Check for the Version of polkit OpenVAS Vulnerability Test Mandriva Update for polkit MDVSA-2011:086 polkit Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under t...

Mandriva Update for polkit MDVSA-2011:086 (polkit)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for polkit FEDORA-2011-5676

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for polkit FEDORA-2011-5676

Check for the Version of polkit OpenVAS Vulnerability Test Fedora Update for polkit FEDORA-2011-5676 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

Mandriva Linux Security Advisory : polkit (MDVSA-2011:086)

A vulnerability has been found and corrected in polkit : A race condition flaw was found in the PolicyKit pkexec utility and polkitd daemon. A local user could use this flaw to appear as a privileged user to pkexec, allowing them to execute arbitrary commands as root by running those commands wit...

Fedora 14 : polkit-0.98-5.fc14 (2011-5676)

Tue Apr 19 2011 David Zeuthen - 0.98-5 - CVE-2011-1485 697951 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Security fix for the ALT Linux 9 package polkit version 0.101-alt2

April 25, 2011 Valery Inozemtsev 0.101-alt2 - update to master git.7c59052 fixed CVE-2011-1485...

Security fix for the ALT Linux 6 package polkit version 0.101-alt2

April 25, 2011 Valery Inozemtsev 0.101-alt2 - update to master git.7c59052 fixed CVE-2011-1485...

Fedora 15 : polkit-0.101-5.fc15 (2011-5589)

Bug 692922 - CVE-2011-1485 polkitd/pkexec vulnerability Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

[slackware-security] polkit

New polkit packages are available for Slackware 13.1 and -current to fix a security issue. Here are the details from the Slackware 13.1 ChangeLog: patches/packages/polkit-114bdfd8-i486-2slack13.1.txz: Rebuilt. Patched to fix a race condition that could allow a local user to execute arbitrary code...

RHEL 6 : polkit (RHSA-2011:0455)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0455 advisory. PolicyKit is a toolkit for defining and handling authorizations. A race condition flaw was found in the PolicyKit pkexec utility and polkitd daemon. ...

polkit: polkitd/pkexec vulnerability

Race condition in the pkexec utility and polkitd daemon in PolicyKit aka polkit 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID...