CVE-2013-1061

2013-09-1800:00:00

ubuntu.com

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

Percentile

5.1%

JSON

dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before
0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not
properly use D-Bus for communication with a polkit authority, which allows
local users to bypass intended access restrictions by leveraging a
PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or
(2) pkexec process, a related issue to CVE-2013-4288.

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchsoftware-properties< 0.82.7.5UNKNOWN
ubuntu12.10noarchsoftware-properties< 0.92.9.3UNKNOWN
ubuntu13.04noarchsoftware-properties< 0.92.17.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	12.04	noarch	software-properties	< 0.82.7.5	UNKNOWN
ubuntu	12.10	noarch	software-properties	< 0.92.9.3	UNKNOWN
ubuntu	13.04	noarch	software-properties	< 0.92.17.3	UNKNOWN