PT-2014-1805 · Kde+5 · Kdelibs+6
Published
2014-07-23
·
Updated
2014-10-29
·
CVE-2014-5033
CVSS v2.0
6.9
Medium
| Vector | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
polkit-qt versions 0.103.0
kdelibs versions prior to 4.14
kauth versions prior to 5.1
Description
The issue allows local users to bypass intended access restrictions, potentially leading to a violation of confidentiality, integrity, and availability of protected information. This can be exploited locally. The problem is related to a PolkitUnixProcess PolkitSubject race condition via a setuid process or pkexec process.
Recommendations
For polkit-qt version 0.103.0, update to a newer version that contains a fix for this issue.
For kdelibs versions prior to 4.14, update to version 4.14 or later.
For kauth versions prior to 5.1, update to version 5.1 or later.
As a temporary workaround, consider restricting access to the polkit authority to minimize the risk of exploitation.
Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Red Hat
Ubuntu
Kauth
Kdelibs
Pkexec
Polkit-Qt