CVE-2013-1062

2013-09-1800:00:00

ubuntu.com

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

Percentile

5.1%

JSON

ubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1, and 0.2.2
before 0.2.2.1 does not properly use D-Bus for communication with a polkit
authority, which allows local users to bypass intended access restrictions
by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1)
setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchubuntu-system-service< 0.2.2.1UNKNOWN
ubuntu12.10noarchubuntu-system-service< 0.2.3.1UNKNOWN
ubuntu13.04noarchubuntu-system-service< 0.2.4.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	12.04	noarch	ubuntu-system-service	< 0.2.2.1	UNKNOWN
ubuntu	12.10	noarch	ubuntu-system-service	< 0.2.3.1	UNKNOWN
ubuntu	13.04	noarch	ubuntu-system-service	< 0.2.4.1	UNKNOWN