NVD

Id
39948  
Name
CVE-2013-4326  
Description
RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.  
Reject
 
CVSS Version
2  
CVSS Score
4.6  
Severity
Medium  
CVSS Base Score
4.6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2013-10-03  
Modified Date
2013-12-08  
Seq
2013-4326  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
203248 39948 CVE-2013-4326 openSUSE-SU-2013:1548  View
203249 39948 CVE-2013-4326 openSUSE-SU-2013:1597  View
203250 39948 CVE-2013-4326 RHSA-2013:1282  View
203251 39948 CVE-2013-4326 [oss-security] 20130918 Re: Fwd: [vs-plain] polkit races  View
203252 39948 CVE-2013-4326 https://bugzilla.redhat.com/show_bug.cgi?id=1006677  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
22923 JVNDB-2013-004498 RealtimeKit におけるアクセス制限を回避される脆弱性 RealtimeKit (別名 rtkit) は、polkit authority との通信に D-Bus を適切に使用しないため、アクセス制限を回避される脆弱性が存在します。 CVE-2013-4326 64268 CVE-2013-4326 39948 4.6 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-004498.html 2013-09-24 2014-01-09 View