PT-2012-1124 · Polkit · Policykit

Samuli Suominen · Published 2012-04-17 · Updated 2023-02-13 · CVE-2011-4945

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PolicyKit versions prior to 0.104

Description The issue concerns multiple vulnerabilities in the polkit package that can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally, potentially allowing unauthorized access to sensitive data. Specifically, in PolicyKit version 0.103, the default setting of AdminIdentities to "wheel" allows local users in the wheel group to gain root privileges without authentication.

Recommendations For versions prior to 0.104, update to version 0.104 or later to resolve the issue. As a temporary workaround, consider modifying the AdminIdentities setting to restrict access to root privileges.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-264

Related Identifiers

BDU:2015-09652

CVE-2011-4945

Affected Products

Policykit

References · 14

• https://osv.dev/vulnerability/CVE-2011-4945 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4945 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201204-06.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-4945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4945 · Security Note
• https://bdu.fstec.ru/vul/2015-09652 · Security Note
• http://cgit.freedesktop.org/PolicyKit/commit/?id=763faf434b445c20ae9529100d3ef5290976d0c9 · Note
• http://openwall.com/lists/oss-security/2012/03/28/1 · Note
• https://bugs.gentoo.org/show_bug.cgi?id=401513 · Note
• http://secunia.com/advisories/48817 · Note
• http://mail-archive.com/polkit-devel%40lists.freedesktop.org/msg00327.html · Note
• http://patch-tracker.debian.org/patch/series/view/policykit-1/0.104-2/05_revert-admin-identities-unix-group-wheel.patch · Note
• https://launchpad.net/ubuntu/+source/policykit-1/0.103-1 · Note
• http://openwall.com/lists/oss-security/2012/03/28/2 · Note