NVD

Id
84865  
Name
CVE-2017-7572  
Description
The _checkPolkitPrivilege function in serviceHelper.py in Back In Time (aka backintime) 1.1.18 and earlier uses a deprecated polkit authorization method (unix-process) that is subject to a race condition (time of check, time of use). With this authorization method, the owner of a process requesting a polkit operation is checked by polkitd via /proc/<pid>/status, by which time the requesting process may have been replaced by a different process with the same PID that has different privileges then the original requester.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-04-27  
Published
2017-04-06  
Modified Date
2017-04-12  
Seq
2017-7572  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
414311 84865 CVE-2017-6361 97059  View
414312 84865 CVE-2017-6361 97072  View
414313 84865 CVE-2017-6361 1038091  View
414314 84865 CVE-2017-6361 https://www.qnap.com/en/support/con_show.php?cid=113  View
414315 84865 CVE-2017-6361 97059  View
414316 84865 CVE-2017-6361 97072  View
414317 84865 CVE-2017-6361 1038091  View
414318 84865 CVE-2017-6361 https://www.qnap.com/en/support/con_show.php?cid=113  View
414319 84865 CVE-2017-6361 97059  View
414320 84865 CVE-2017-6361 97072  View
414321 84865 CVE-2017-6361 1038091  View
414322 84865 CVE-2017-6361 https://www.qnap.com/en/support/con_show.php?cid=113  View
417712 84865 CVE-2017-3037 97556  View
417713 84865 CVE-2017-3037 https://helpx.adobe.com/security/products/acrobat/apsb17-11.html  View
417714 84865 CVE-2017-3037 97556  View
417715 84865 CVE-2017-3037 https://helpx.adobe.com/security/products/acrobat/apsb17-11.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
66693 JVNDB-2017-003018 Back In Time における競合状態に関する脆弱性 Back In Time (別名 backintime) には、競合状態に関する脆弱性が存在します。 CVE-2017-7572 0 CVE-2017-7572 84865 9.3 8.1 http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-003018.html 2017-04-05 2017-05-11 View