PT-2015-2602 · Freedesktop.Org+3 · Policykit+3
Colin Walters
·
Publicado
2015-07-02
·
Atualizado
2018-10-30
·
CVE-2015-4625
CVSS v2.0
4.6
Média
| Vetor | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
PolicyKit versions prior to 0.113
Description
The issue is related to an integer overflow in the
authentication agent new cookie function. This allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value. The exploitation of this issue can enable a local attacker to elevate their privileges.Recommendations
For versions prior to 0.113, update to version 0.113 or later to resolve the issue. As a temporary workaround, consider restricting the ability to create a large number of connections to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Policykit
Suse
Ubuntu