CVE-2013-4327

 

Published at: - 03-10-2013 11:55

Last modified: - 31-01-2022 06:39

Total changes: - 2

Description

systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Common Vulnerability Scoring System (CVSS)

AV:L/AC:M/Au:N/C:C/I:C/A:C

 

Verification logic

 

Reference

• USN-1961-1-Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1006680
• [oss-security] 20130918 Re: Fwd: [vs-plain] polkit races-Mailing List, Third Party Advisory
• DSA-2777-Third Party Advisory

 

Keywords

NVD

 

CVE-2013-4327

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures