PT-2008-3210 · Policykit · Policykit

Kees + 1 · Published 2008-04-11 · Updated 2017-08-08 · CVE-2008-1658

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PolicyKit versions 0.7 and earlier

Description The issue is related to a format string vulnerability in the grant helper of PolicyKit. This vulnerability allows attackers to cause a denial of service, potentially leading to a crash, and may also enable the execution of arbitrary code. The vulnerability is triggered by format strings in a password.

Recommendations For versions 0.7 and earlier, consider updating to a version later than 0.7 to resolve the issue. As a temporary workaround, restrict the use of the grant helper to minimize the risk of exploitation.

Exploit

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2008-1658

Affected Products

Policykit

References · 14

• 🔥 http://gitweb.freedesktop.org/?p=PolicyKit.git;a=commitdiff;h=5bc86a14cc0e356bcf8b5f861674f842869b1be7 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1658 · Security Note
• https://osv.dev/vulnerability/CVE-2008-1658 · Vendor Advisory
• http://securityfocus.com/bid/28702 · Patch
• https://security-tracker.debian.org/tracker/CVE-2008-1658 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-April/msg00176.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:087 · Vendor Advisory
• http://secunia.com/advisories/29755 · Vendor Advisory
• http://vupen.com/english/advisories/2008/1254 · Note
• https://bugs.launchpad.net/ubuntu/+source/policykit/+bug/205037 · Note
• http://gitweb.freedesktop.org/?p=PolicyKit.git%3Ba=commitdiff%3Bh=5bc86a14cc0e356bcf8b5f861674f842869b1be7 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41877 · Note
• http://bugs.freedesktop.org/show_bug.cgi?id=15295 · Note