Published: 03/10/2013 Updated: 22/04/2019

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

VMScore: 409

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Vulnerable Product	Search on Vulmon	Subscribe to Product
lennart poettering rkit 0.5
redhat enterprise linux 6.0

Synopsis Important: rtkit security update Type/Severity Security Advisory: Important Topic An updated rtkit package that fixes one security issue is now available forRed Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as havingimportant security impact A Common Vulnerability ...

Debian Bug report logs - #723714 rtkit: CVE-2013-4326 Package: rtkit; Maintainer for rtkit is Debian Multimedia Maintainers <debian-multimedia@listsdebianorg>; Source for rtkit is src:rtkit (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Thu, 19 Sep 2013 05:51:01 UTC Severity: grave Ta ...

RealtimeKit could be tricked into bypassing polkit authorizations ...

RealtimeKit (aka rtkit) 05 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288 ...

CWE-264 https://bugzilla.redhat.com/show_bug.cgi?id=1006677 http://rhn.redhat.com/errata/RHSA-2013-1282.html http://www.openwall.com/lists/oss-security/2013/09/18/6 http://lists.opensuse.org/opensuse-updates/2013-10/msg00022.html http://lists.opensuse.org/opensuse-updates/2013-10/msg00051.html https://access.redhat.com/errata/RHSA-2013:1282 https://usn.ubuntu.com/1959-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2013-4326

CVE-2013-4326

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect