This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Polkit Project First view 2013-10-03
Product Polkit Last view 2019-01-11
Version Type
Update  
Edition  
Language  
Sofware Edition  
Target Software  
Target Hardware  
Other  

Activity : Overall

COMMON PLATFORM ENUMERATION: Repartition per Version

CPE Name Affected CVE
cpe:2.3:a:polkit_project:polkit:-:*:*:*:*:*:*:* 6
cpe:2.3:a:polkit_project:polkit:0.112:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.3:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.4:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.5:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.6:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.7:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.8:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.9:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.91:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.92:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.93:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.94:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.95:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.96:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.97:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.98:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.99:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.100:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.101:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.102:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.103:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.104:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.105:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.106:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.107:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.108:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.109:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.110:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.111:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:*:*:*:*:*:*:*:* 5
cpe:2.3:a:polkit_project:polkit:0.115:*:*:*:*:*:*:* 2
cpe:2.3:a:polkit_project:polkit:0.113:*:*:*:*:*:*:* 1
cpe:2.3:a:polkit_project:polkit:0.114:*:*:*:*:*:*:* 1

Related : CVE

  Date Alert Description
6.7 2019-01-11 CVE-2019-6133

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

8.8 2018-12-03 CVE-2018-19788

A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully execute any systemctl command.

4.4 2018-07-10 CVE-2018-1116

A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.

4.6 2015-10-26 CVE-2015-4625

Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.

4.6 2015-10-26 CVE-2015-3256

PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation."

4.6 2015-10-26 CVE-2015-3255

The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions.

2.1 2015-10-26 CVE-2015-3218

The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path.

7.2 2013-10-03 CVE-2013-4288

Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.

CWE : Common Weakness Enumeration

%idName
33% (2) CWE-264 Permissions, Privileges, and Access Controls
16% (1) CWE-362 Race Condition
16% (1) CWE-284 Access Control (Authorization) Issues
16% (1) CWE-189 Numeric Errors
16% (1) CWE-20 Improper Input Validation

Oval Markup Language : Definitions

OvalID Name
oval:org.mitre.oval:def:20783 RHSA-2013:1270: polkit security update (Important)
oval:org.mitre.oval:def:19023 USN-1953-1 -- policykit-1 vulnerability
oval:org.mitre.oval:def:23974 ELSA-2013:1270: polkit security update (Important)
oval:org.mitre.oval:def:27203 DEPRECATED: ELSA-2013-1270 -- polkit security update (important)

Nessus® Vulnerability Scanner

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2019-01-03 Name: The remote Fedora host is missing a security update.
File: fedora_2018-fef8a691a6.nasl - Type: ACT_GATHER_INFO
2019-01-03 Name: The remote Fedora host is missing a security update.
File: fedora_2018-4ac3c68ee4.nasl - Type: ACT_GATHER_INFO
2019-01-03 Name: The remote Fedora host is missing a security update.
File: fedora_2018-2f8696869e.nasl - Type: ACT_GATHER_INFO
2018-12-07 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-4350.nasl - Type: ACT_GATHER_INFO
2018-08-02 Name: The remote Fedora host is missing a security update.
File: fedora_2018-83df5dc658.nasl - Type: ACT_GATHER_INFO
2018-07-30 Name: The remote Debian host is missing a security update.
File: debian_DLA-1448.nasl - Type: ACT_GATHER_INFO
2016-11-15 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201611-07.nasl - Type: ACT_GATHER_INFO
2016-02-17 Name: The remote Scientific Linux host is missing one or more security updates.
File: sl_20160216_polkit_on_SL7_x.nasl - Type: ACT_GATHER_INFO
2016-02-17 Name: The remote Red Hat host is missing one or more security updates.
File: redhat-RHSA-2016-0189.nasl - Type: ACT_GATHER_INFO
2016-02-17 Name: The remote Oracle Linux host is missing one or more security updates.
File: oraclelinux_ELSA-2016-0189.nasl - Type: ACT_GATHER_INFO
2016-02-17 Name: The remote CentOS host is missing one or more security updates.
File: centos_RHSA-2016-0189.nasl - Type: ACT_GATHER_INFO
2016-01-11 Name: The remote FreeBSD host is missing a security-related update.
File: freebsd_pkg_631fc042b63611e583ef14dae9d210b8.nasl - Type: ACT_GATHER_INFO
2015-11-20 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2015-711.nasl - Type: ACT_GATHER_INFO
2015-10-29 Name: The remote SUSE host is missing one or more security updates.
File: suse_SU-2015-1838-1.nasl - Type: ACT_GATHER_INFO
2015-10-15 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2015-655.nasl - Type: ACT_GATHER_INFO
2015-07-22 Name: The remote Fedora host is missing a security update.
File: fedora_2015-11743.nasl - Type: ACT_GATHER_INFO
2015-07-14 Name: The remote Fedora host is missing a security update.
File: fedora_2015-11058.nasl - Type: ACT_GATHER_INFO
2014-11-08 Name: The remote Red Hat host is missing a security update.
File: redhat-RHSA-2013-1460.nasl - Type: ACT_GATHER_INFO
2014-06-27 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201406-27.nasl - Type: ACT_GATHER_INFO
2014-06-13 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2013-812.nasl - Type: ACT_GATHER_INFO
2014-06-13 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2013-738.nasl - Type: ACT_GATHER_INFO
2014-06-13 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2013-737.nasl - Type: ACT_GATHER_INFO
2013-09-28 Name: The remote Mandriva Linux host is missing one or more security updates.
File: mandriva_MDVSA-2013-243.nasl - Type: ACT_GATHER_INFO
2013-09-23 Name: The remote Fedora host is missing a security update.
File: fedora_2013-17160.nasl - Type: ACT_GATHER_INFO
2013-09-22 Name: The remote Fedora host is missing a security update.
File: fedora_2013-17197.nasl - Type: ACT_GATHER_INFO