spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkit_unix_process_new API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

The remote host is affected by the vulnerability described in GLSA-201406-27 (polkit, Spice-Gtk, systemd, HPLIP, libvirt: Privilege escalation)

    polkit has a race condition which potentially allows a process to change       its UID/EUID via suid or pkexec before authentication is completed.
  Impact :

    A local attacker could start a suid or pkexec process through a       polkit-enabled application, which could result in privilege escalation or       bypass of polkit restrictions.
  Workaround :

    There is no known workaround at this time.

spice-gtk received fixes for the acl helper policy kit checks that had a race condition in PID checking. (CVE-2013-4324, bnc#844967).

Fix CVE-2013-4324 Insecure calling of polkit via polkit_unix_process_new() Add a few upstream patches fixing bugs in spice-gtk 0.20

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

spice-gtk communicated with PolicyKit for authorization via an API that is vulnerable to a race condition. This could lead to intended PolicyKit authorizations being bypassed. This update modifies spice-gtk to communicate with PolicyKit via a different API that is not vulnerable to the race condition. (CVE-2013-4324)

Updated spice-gtk packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The spice-gtk packages provide a GIMP Toolkit (GTK+) widget for SPICE (Simple Protocol for Independent Computing Environments) clients. Both Virtual Machine Manager and Virtual Machine Viewer can make use of this widget to access virtual machines using the SPICE protocol.

spice-gtk communicated with PolicyKit for authorization via an API that is vulnerable to a race condition. This could lead to intended PolicyKit authorizations being bypassed. This update modifies spice-gtk to communicate with PolicyKit via a different API that is not vulnerable to the race condition. (CVE-2013-4324)

All users of spice-gtk are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1273 advisory.

    - New build with correct patch for CVE-2013-4324

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
76271	GLSA-201406-27 : polkit, Spice-Gtk, systemd, HPLIP, libvirt: Privilege escalation	Nessus	Gentoo Local Security Checks	high
75172	openSUSE Security Update : spice-gtk (openSUSE-SU-2013:1562-1)	Nessus	SuSE Local Security Checks	medium
70157	Fedora 19 : spice-gtk-0.20-6.fc19 (2013-17109)	Nessus	Fedora Local Security Checks	medium
70017	Scientific Linux Security Update : spice-gtk on SL6.x i386/x86_64 (20130919)	Nessus	Scientific Linux Local Security Checks	medium
70012	RHEL 6 : spice-gtk (RHSA-2013:1273)	Nessus	Red Hat Local Security Checks	medium
70008	Oracle Linux 6 : spice-gtk (ELSA-2013-1273)	Nessus	Oracle Linux Local Security Checks	critical
70000	CentOS 6 : spice-gtk (CESA-2013:1273)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2013-4324

high

Tenable Plugins

high

medium

medium

medium

medium

critical

medium