Executive Summary

Summary
Title polkit, Spice-Gtk, systemd, HPLIP, libvirt: Privilege escalation
Informations
Name GLSA-201406-27 First vendor Publication 2014-06-26
Vendor Gentoo Last vendor Modification 2014-06-26
Severity (Vendor) High Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 7.2 Attack Range Local
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 3.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

A race condition in polkit could allow a local attacker to gain escalated privileges.

Background

polkit is a toolkit for managing policies relating to unprivileged processes communicating with privileged processes.

Description

polkit has a race condition which potentially allows a process to change its UID/EUID via suid or pkexec before authentication is completed.

Impact

A local attacker could start a suid or pkexec process through a polkit-enabled application, which could result in privilege escalation or bypass of polkit restrictions.

Workaround

There is no known workaround at this time.

Resolution

All polkit users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-auth/polkit-0.112"

All HPLIP users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-print/hplip-3.14.1"

All Spice-Gtk users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/spice-gtk-0.21"

All systemd users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/systemd-204-r1"

All libvirt users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-emulation/libvirt-1.1.2-r3"

References

[ 1 ] CVE-2013-4288 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4288
[ 2 ] CVE-2013-4311 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4311
[ 3 ] CVE-2013-4324 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4324
[ 4 ] CVE-2013-4325 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4325
[ 5 ] CVE-2013-4327 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4327

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201406-27.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201406-27.xml

CWE : Common Weakness Enumeration

% Id Name
80 % CWE-264 Permissions, Privileges, and Access Controls
20 % CWE-362 Race Condition

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:18931
 
Oval ID: oval:org.mitre.oval:def:18931
Title: USN-1961-1 -- systemd vulnerability
Description: systemd could be tricked into bypassing polkit authorizations.
Family: unix Class: patch
Reference(s): USN-1961-1
CVE-2013-4327
Version: 5
Platform(s): Ubuntu 13.04
Product(s): systemd
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19023
 
Oval ID: oval:org.mitre.oval:def:19023
Title: USN-1953-1 -- policykit-1 vulnerability
Description: polkit could be tricked into giving out improper authorization.
Family: unix Class: patch
Reference(s): USN-1953-1
CVE-2013-4288
Version: 5
Platform(s): Ubuntu 13.04
Ubuntu 12.10
Ubuntu 12.04
Ubuntu 10.04
Product(s): policykit-1
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19347
 
Oval ID: oval:org.mitre.oval:def:19347
Title: USN-1956-1 -- hplip vulnerability
Description: HPLIP could be tricked into bypassing polkit authorizations.
Family: unix Class: patch
Reference(s): USN-1956-1
CVE-2013-4325
Version: 5
Platform(s): Ubuntu 13.04
Ubuntu 12.10
Ubuntu 12.04
Ubuntu 10.04
Product(s): hplip
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20783
 
Oval ID: oval:org.mitre.oval:def:20783
Title: RHSA-2013:1270: polkit security update (Important)
Description: Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.
Family: unix Class: patch
Reference(s): RHSA-2013:1270-00
CESA-2013:1270
CVE-2013-4288
Version: 4
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
Product(s): polkit
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21168
 
Oval ID: oval:org.mitre.oval:def:21168
Title: RHSA-2013:1273: spice-gtk security update (Important)
Description: spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkit_unix_process_new API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Family: unix Class: patch
Reference(s): RHSA-2013:1273-00
CESA-2013:1273
CVE-2013-4324
Version: 4
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
Product(s): spice-gtk
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21246
 
Oval ID: oval:org.mitre.oval:def:21246
Title: RHSA-2013:1274: hplip security update (Important)
Description: The check_permission_v1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.9 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process.
Family: unix Class: patch
Reference(s): RHSA-2013:1274-00
CESA-2013:1274
CVE-2013-4325
Version: 4
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
Product(s): hplip
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21256
 
Oval ID: oval:org.mitre.oval:def:21256
Title: RHSA-2013:1272: libvirt security and bug fix update (Important)
Description: libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Family: unix Class: patch
Reference(s): RHSA-2013:1272-00
CESA-2013:1272
CVE-2013-4296
CVE-2013-4311
Version: 31
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
Product(s): libvirt
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23514
 
Oval ID: oval:org.mitre.oval:def:23514
Title: ELSA-2013:1272: libvirt security and bug fix update (Important)
Description: libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Family: unix Class: patch
Reference(s): ELSA-2013:1272-00
CVE-2013-4296
CVE-2013-4311
Version: 13
Platform(s): Oracle Linux 6
Product(s): libvirt
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23555
 
Oval ID: oval:org.mitre.oval:def:23555
Title: ELSA-2013:1274: hplip security update (Important)
Description: The check_permission_v1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.9 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process.
Family: unix Class: patch
Reference(s): ELSA-2013:1274-00
CVE-2013-4325
Version: 6
Platform(s): Oracle Linux 6
Product(s): hplip
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23974
 
Oval ID: oval:org.mitre.oval:def:23974
Title: ELSA-2013:1270: polkit security update (Important)
Description: Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.
Family: unix Class: patch
Reference(s): ELSA-2013:1270-00
CVE-2013-4288
Version: 6
Platform(s): Oracle Linux 6
Product(s): polkit
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24186
 
Oval ID: oval:org.mitre.oval:def:24186
Title: ELSA-2013:1273: spice-gtk security update (Important)
Description: spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkit_unix_process_new API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
Family: unix Class: patch
Reference(s): ELSA-2013:1273-00
CVE-2013-4324
Version: 6
Platform(s): Oracle Linux 6
Product(s): spice-gtk
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27031
 
Oval ID: oval:org.mitre.oval:def:27031
Title: DEPRECATED: ELSA-2013-1273 -- spice-gtk security update (important)
Description: [0.14-7.3] - New build with correct patch for CVE-2013-4324 [0.14-7.2] - Fix race condition in policykit use (CVE-2013-4324) Resolves: CVE-2013-4324
Family: unix Class: patch
Reference(s): ELSA-2013-1273
CVE-2013-4324
Version: 4
Platform(s): Oracle Linux 6
Product(s): spice-gtk
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27203
 
Oval ID: oval:org.mitre.oval:def:27203
Title: DEPRECATED: ELSA-2013-1270 -- polkit security update (important)
Description: [0.96-5] - Actually apply the patch, and modify it to apply to 0.96 - Resolves: #1006262 [0.96-4.el6_4] - Include fix for CVE-2013-4288 - Resolves: #1006262 [0.96-3.el6_4] - Include fixes for CVE-2011-1485 - Resolves: #692942
Family: unix Class: patch
Reference(s): ELSA-2013-1270
CVE-2013-4288
Version: 4
Platform(s): Oracle Linux 6
Product(s): polkit
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27235
 
Oval ID: oval:org.mitre.oval:def:27235
Title: DEPRECATED: ELSA-2013-1272 -- libvirt security and bug fix update (important)
Description: [0.10.2-18.0.1.el6_4.14] - Replace docs/et.png in tarball with blank image [0.10.2-18.el6_4.14] - spec: Update requirements to pick up rebuilt polkit (CVE-2013-4311) [0.10.2-18.el6_4.13] - spec: Fix messed up dependency on polkit (CVE-2013-4311) [0.10.2-18.el6_4.12] - Introduce APIs for splitting/joining strings (rhbz#1006265) - Rename virKillProcess to virProcessKill (rhbz#1006265) - Rename virPid{Abort, Wait} to virProcess{Abort, Wait} (rhbz#1006265) - Rename virCommandTranslateStatus to virProcessTranslateStatus (rhbz#1006265) - Move virProcessKill into virprocess.{h, c} (rhbz#1006265) - Move virProcess{Kill, Abort, TranslateStatus} into virprocess.{c, h} (rhbz#1006265) - Include process start time when doing polkit checks (rhbz#1006265) - Add support for using 3-arg pkcheck syntax for process (CVE-2013-4311) [0.10.2-18.el6_4.11] - Fix crash in remoteDispatchDomainMemoryStats (CVE-2013-4296) [0.10.2-18.el6_4.10] - qemu: Avoid leaking uri in qemuMigrationPrepareDirect (rhbz#984578) - qemu: Fix double free in qemuMigrationPrepareDirect (rhbz#984578) [when parsing a single device (rhbz#1003934)] - Plug leak in virCgroupMoveTask (rhbz#984556) - Fix invalid read in virCgroupGetValueStr (rhbz#984561)
Family: unix Class: patch
Reference(s): ELSA-2013-1272
CVE-2013-4296
CVE-2013-4311
Version: 4
Platform(s): Oracle Linux 6
Product(s): libvirt
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27501
 
Oval ID: oval:org.mitre.oval:def:27501
Title: DEPRECATED: ELSA-2013-1274 -- hplip security update (important)
Description: [3.12.4-4:.1] - Applied patch to avoid unix-process authorization subject when using polkit as it is racy (CVE-2013-4325).
Family: unix Class: patch
Reference(s): ELSA-2013-1274
CVE-2013-4325
Version: 4
Platform(s): Oracle Linux 6
Product(s): hplip
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 35
Application 1
Application 15
Application 1
Application 1
Os 4
Os 1
Os 2
Os 1

Nessus® Vulnerability Scanner

Date Description
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2013-1460.nasl - Type : ACT_GATHER_INFO
2014-06-27 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201406-27.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-812.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-777.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-737.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-738.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-763.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-764.nasl - Type : ACT_GATHER_INFO
2014-02-04 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_hplip-140116.nasl - Type : ACT_GATHER_INFO
2013-12-31 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2829.nasl - Type : ACT_GATHER_INFO
2013-12-20 Name : The remote Fedora host is missing a security update.
File : fedora_2013-17195.nasl - Type : ACT_GATHER_INFO
2013-11-09 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libvirt-131004.nasl - Type : ACT_GATHER_INFO
2013-10-20 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2013-291-01.nasl - Type : ACT_GATHER_INFO
2013-10-20 Name : The remote Fedora host is missing a security update.
File : fedora_2013-17112.nasl - Type : ACT_GATHER_INFO
2013-10-13 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2777.nasl - Type : ACT_GATHER_INFO
2013-10-13 Name : The remote Fedora host is missing a security update.
File : fedora_2013-18455.nasl - Type : ACT_GATHER_INFO
2013-10-10 Name : The remote Fedora host is missing a security update.
File : fedora_2013-17171.nasl - Type : ACT_GATHER_INFO
2013-10-03 Name : The remote Fedora host is missing a security update.
File : fedora_2013-17618.nasl - Type : ACT_GATHER_INFO
2013-10-01 Name : The remote Fedora host is missing a security update.
File : fedora_2013-17305.nasl - Type : ACT_GATHER_INFO
2013-09-28 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-243.nasl - Type : ACT_GATHER_INFO
2013-09-27 Name : The remote Fedora host is missing a security update.
File : fedora_2013-17109.nasl - Type : ACT_GATHER_INFO
2013-09-23 Name : The remote Fedora host is missing a security update.
File : fedora_2013-17203.nasl - Type : ACT_GATHER_INFO
2013-09-23 Name : The remote Fedora host is missing a security update.
File : fedora_2013-17160.nasl - Type : ACT_GATHER_INFO
2013-09-23 Name : The remote Fedora host is missing a security update.
File : fedora_2013-17176.nasl - Type : ACT_GATHER_INFO
2013-09-22 Name : The remote Fedora host is missing a security update.
File : fedora_2013-17119.nasl - Type : ACT_GATHER_INFO
2013-09-22 Name : The remote Fedora host is missing a security update.
File : fedora_2013-17197.nasl - Type : ACT_GATHER_INFO
2013-09-21 Name : The remote Fedora host is missing a security update.
File : fedora_2013-17191.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1273.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20130919_spice_gtk_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20130919_polkit_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20130919_libvirt_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1274.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1270.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1272.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1273.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1274.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote Fedora host is missing a security update.
File : fedora_2013-17127.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1270.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1272.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1274.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1270.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1272.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1273.nasl - Type : ACT_GATHER_INFO
2013-09-20 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20130919_hplip_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-09-19 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1961-1.nasl - Type : ACT_GATHER_INFO
2013-09-19 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1956-1.nasl - Type : ACT_GATHER_INFO
2013-09-19 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1954-1.nasl - Type : ACT_GATHER_INFO
2013-09-19 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1953-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-06-28 13:27:17
  • Multiple Updates
2014-06-27 05:26:04
  • First insertion