CVE-2013-4288

NONE EPSS 26.2%
Published Oct 3, 201312y ago · Modified Jun 16, 20262w ago
Find Similar
Published Oct 3, 2013 12y ago
Last Modified Jun 16, 2026 2w ago

Description

Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.

Threat Intelligence

EPSS Exploit Probability
26.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-362

Affected Products 8

VendorProductVersionRange
opensuseopensuse12.2any
opensuseopensuse12.3any
polkit_projectpolkit* <0.112.1
canonicalubuntu_linux10.04any
canonicalubuntu_linux12.04any
canonicalubuntu_linux12.10any
canonicalubuntu_linux13.04any
redhatenterprise_linux6.0any

References 10

  • bugzilla.redhat.com http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1002375
    Issue TrackingPatchThird Party Advisory
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2013-10/msg00004.html
    Mailing ListThird Party Advisory
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2013-10/msg00005.html
    Mailing ListThird Party Advisory
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2013-10/msg00062.html
    Mailing ListThird Party Advisory
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2013-11/msg00000.html
    Mailing ListThird Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2013-1270.html
    Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2013-1460.html
    Third Party Advisory
  • seclists.org http://seclists.org/oss-sec/2013/q3/626
    Mailing ListThird Party Advisory
  • openwall.com http://www.openwall.com/lists/oss-security/2013/09/18/4
    Mailing ListThird Party Advisory
  • ubuntu.com http://www.ubuntu.com/usn/USN-1953-1
    Third Party Advisory

Remediation

  • bugzilla.redhat.com http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=1002375
    Issue TrackingPatchThird Party Advisory