NVD

Id
32858  
Name
CVE-2014-5033  
Description
KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions."  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2014-08-19  
Modified Date
2014-10-16  
Seq
2014-5033  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
172594 32858 CVE-2014-5033 openSUSE-SU-2014:0981  View
172595 32858 CVE-2014-5033 http://quickgit.kde.org/?p=kauth.git&a=commit&h=341b7d84b6d9c03cf56905cb277b47e11c81482a  View
172596 32858 CVE-2014-5033 http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=e4e7b53b71e2659adaf52691d4accc3594203b23  View
172597 32858 CVE-2014-5033 RHSA-2014:1359  View
172598 32858 CVE-2014-5033 DSA-3004  View
172599 32858 CVE-2014-5033 http://www.kde.org/info/security/advisory-20140730-1.txt  View
172600 32858 CVE-2014-5033 USN-2304-1  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14994 JVNDB-2014-003869 KDE kdelibs および kauth におけるアクセス制限を回避される脆弱性 KDE kdelibs および kauth には、polkit authority との通信に D-Bus を適切に使用しないため、アクセス制限を回避される脆弱性が存在します。 CVE-2014-5033 72322 CVE-2014-5033 32858 6.9 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003869.html 2014-07-30 2014-08-21 View