Vulnerability Details CVE-2013-4288
Race condition in PolicyKit (aka polkit) allows local users to bypass intended PolicyKit restrictions and gain privileges by starting a setuid or pkexec process before the authorization check is performed, related to (1) the polkit_unix_process_new API function, (2) the dbus API, or (3) the --process (unix-process) option for authorization to pkcheck.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 13.1%
CVSS Severity
CVSS v2 Score 7.2
Products affected by CVE-2013-4288
-
cpe:2.3:a:polkit_project:polkit:-
-
cpe:2.3:a:polkit_project:polkit:0.100
-
cpe:2.3:a:polkit_project:polkit:0.101
-
cpe:2.3:a:polkit_project:polkit:0.102
-
cpe:2.3:a:polkit_project:polkit:0.103
-
cpe:2.3:a:polkit_project:polkit:0.104
-
cpe:2.3:a:polkit_project:polkit:0.105
-
cpe:2.3:a:polkit_project:polkit:0.106
-
cpe:2.3:a:polkit_project:polkit:0.107
-
cpe:2.3:a:polkit_project:polkit:0.108
-
cpe:2.3:a:polkit_project:polkit:0.109
-
cpe:2.3:a:polkit_project:polkit:0.110
-
cpe:2.3:a:polkit_project:polkit:0.111
-
cpe:2.3:a:polkit_project:polkit:0.112
-
cpe:2.3:a:polkit_project:polkit:0.3
-
cpe:2.3:a:polkit_project:polkit:0.4
-
cpe:2.3:a:polkit_project:polkit:0.5
-
cpe:2.3:a:polkit_project:polkit:0.6
-
cpe:2.3:a:polkit_project:polkit:0.7
-
cpe:2.3:a:polkit_project:polkit:0.8
-
cpe:2.3:a:polkit_project:polkit:0.9
-
cpe:2.3:a:polkit_project:polkit:0.91
-
cpe:2.3:a:polkit_project:polkit:0.92
-
cpe:2.3:a:polkit_project:polkit:0.93
-
cpe:2.3:a:polkit_project:polkit:0.94
-
cpe:2.3:a:polkit_project:polkit:0.95
-
cpe:2.3:a:polkit_project:polkit:0.96
-
cpe:2.3:a:polkit_project:polkit:0.97
-
cpe:2.3:a:polkit_project:polkit:0.98
-
cpe:2.3:a:polkit_project:polkit:0.99
-
cpe:2.3:o:canonical:ubuntu_linux:10.04
-
cpe:2.3:o:canonical:ubuntu_linux:12.04
-
cpe:2.3:o:canonical:ubuntu_linux:12.10
-
cpe:2.3:o:canonical:ubuntu_linux:13.04
-
cpe:2.3:o:opensuse:opensuse:12.2
-
cpe:2.3:o:opensuse:opensuse:12.3
-
cpe:2.3:o:redhat:enterprise_linux:6.0