PT-2014-1805 · Kde+5 · Kdelibs+6
Publicado
2014-07-23
·
Atualizado
2014-10-29
·
CVE-2014-5033
CVSS v2.0
6.9
Média
| Vetor | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
polkit-qt versions 0.103.0
kdelibs versions prior to 4.14
kauth versions prior to 5.1
Description
The issue allows local users to bypass intended access restrictions, potentially leading to a violation of confidentiality, integrity, and availability of protected information. This can be exploited locally. The problem is related to a PolkitUnixProcess PolkitSubject race condition via a setuid process or pkexec process.
Recommendations
For polkit-qt version 0.103.0, update to a newer version that contains a fix for this issue.
For kdelibs versions prior to 4.14, update to version 4.14 or later.
For kauth versions prior to 5.1, update to version 5.1 or later.
As a temporary workaround, consider restricting access to the polkit authority to minimize the risk of exploitation.
Exploit
Correção
Race Condition
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Red Hat
Ubuntu
Kauth
Kdelibs
Pkexec
Polkit-Qt