LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: July 18th, 2014
Linux Advisory Watch: July 13th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Mandriva: 2013:243: polkit Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Mandrake Updated polkit packages fix security vulnerability: A race condition was found in the way the PolicyKit pkcheck utility checked process authorization when the process was specified by its process ID via the --process option. A local user could use this [More...]
 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2013:243
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : polkit
 Date    : September 27, 2013
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated polkit packages fix security vulnerability:
 
 A race condition was found in the way the PolicyKit pkcheck utility
 checked process authorization when the process was specified by its
 process ID via the --process option. A local user could use this
 flaw to bypass intended PolicyKit authorizations and escalate their
 privileges (CVE-2013-4288).
 
 Note: Applications that invoke pkcheck with the --process option need
 to be modified to use the pid,pid-start-time,uid argument for that
 option, to allow pkcheck to check process authorization correctly.
 
 Because of the change in the PolicyKit API, hplip (CVE-2013-4325),
 rtkit (CVE-2013-4326), and systemd (CVE-2013-4327) packages have
 been updated to use a different API that is not affected by this
 PolicyKit vulnerability.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4288
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4325
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4326
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4327
 https://bugs.mageia.org/show_bug.cgi?id=11260
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 1/X86_64:
 a505f84a730fe73329a47e34c63a7dbe  mbs1/x86_64/hplip-3.12.4-1.1.mbs1.x86_64.rpm
 3a4ba0c6f598df5d0a895e92d86bdee6  mbs1/x86_64/hplip-doc-3.12.4-1.1.mbs1.x86_64.rpm
 5ff79b31c0d10f328cb3a33e73ee443f  mbs1/x86_64/hplip-hpijs-3.12.4-1.1.mbs1.x86_64.rpm
 06ad03c60671fdc268f68c19abccdead  mbs1/x86_64/hplip-hpijs-ppds-3.12.4-1.1.mbs1.x86_64.rpm
 464c910aa533f8a8bb2f2c3022127339  mbs1/x86_64/hplip-model-data-3.12.4-1.1.mbs1.x86_64.rpm
 c868787d3990ecfdae81124e449b9fe5  mbs1/x86_64/lib64hpip0-3.12.4-1.1.mbs1.x86_64.rpm
 16b802096b39e33c3c2e048e5034f6ee  mbs1/x86_64/lib64hpip0-devel-3.12.4-1.1.mbs1.x86_64.rpm
 d9832f1d43a46d48de126d112744a63f  mbs1/x86_64/lib64polkit1_0-0.104-6.1.mbs1.x86_64.rpm
 7cb376fc2241b8ef5d9fec5d56f8b44e  mbs1/x86_64/lib64polkit1-devel-0.104-6.1.mbs1.x86_64.rpm
 6bd18537f831797178c8d8797ddb38c8  mbs1/x86_64/lib64polkit-gir1.0-0.104-6.1.mbs1.x86_64.rpm
 bf1d4dfcde5c3268d93d3410686390cf  mbs1/x86_64/lib64sane-hpaio1-3.12.4-1.1.mbs1.x86_64.rpm
 03c53c95ae85aa80d715eba6cb0a568e  mbs1/x86_64/lib64systemd-daemon0-44-16.1.mbs1.x86_64.rpm
 3d652b24d8237db4354232c58da626f7  mbs1/x86_64/lib64systemd-daemon0-devel-44-16.1.mbs1.x86_64.rpm
 720ca216bd163136e6157fae2ce3a8ce  mbs1/x86_64/lib64systemd-id1280-44-16.1.mbs1.x86_64.rpm
 3dec561fc60e5670f775759d279b73f9  mbs1/x86_64/lib64systemd-id1280-devel-44-16.1.mbs1.x86_64.rpm
 a5f09de0fe35f59d4f03c44d60706fc8  mbs1/x86_64/lib64systemd-journal0-44-16.1.mbs1.x86_64.rpm
 1aa5d342f5e1ea17ad23a3adcb846b67  mbs1/x86_64/lib64systemd-journal0-devel-44-16.1.mbs1.x86_64.rpm
 989d00585eda3757067bd7757760d21f  mbs1/x86_64/lib64systemd-login0-44-16.1.mbs1.x86_64.rpm
 a64fbbeaf21c77c50bda1fff4278a34c  mbs1/x86_64/lib64systemd-login0-devel-44-16.1.mbs1.x86_64.rpm
 03ba458caeb642419984d0984ea156b9  mbs1/x86_64/polkit-0.104-6.1.mbs1.x86_64.rpm
 f58526b0a6b7dd710d6ae50c401f3ca1  mbs1/x86_64/polkit-desktop-policy-0.104-6.1.mbs1.noarch.rpm
 535391c9d869772e68cd13adac519113  mbs1/x86_64/rtkit-0.10-3.1.mbs1.x86_64.rpm
 867308654e786d01f4c66054cca07ab5  mbs1/x86_64/systemd-44-16.1.mbs1.x86_64.rpm
 52e155e8f9d39745da50bd8bcea8cd54  mbs1/x86_64/systemd-sysvinit-44-16.1.mbs1.x86_64.rpm
 f71f9b8a5f1676bc3af636e510f9c7a8  mbs1/x86_64/systemd-tools-44-16.1.mbs1.x86_64.rpm
 959a6d57120d110fc44178581105eb55  mbs1/x86_64/systemd-units-44-16.1.mbs1.x86_64.rpm 
 119ee4665dda5c72402c2fdf7d6c5298  mbs1/SRPMS/hplip-3.12.4-1.1.mbs1.src.rpm
 f78ac8cf2fc3c60849ae806c1de0c4dd  mbs1/SRPMS/polkit-0.104-6.1.mbs1.src.rpm
 0af0c0abd85fc991c6592365cc93dd6e  mbs1/SRPMS/rtkit-0.10-3.1.mbs1.src.rpm
 3ac52aac654aaf3f3fefde1207e827e4  mbs1/SRPMS/systemd-44-16.1.mbs1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Home router security holes to be exposed at Def Con 22 hacker meet up
Edward Snowden Calls on Hackers to Help Whistleblowers Leak More Secrets
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.