systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

The remote host is affected by the vulnerability described in GLSA-201406-27 (polkit, Spice-Gtk, systemd, HPLIP, libvirt: Privilege escalation)

    polkit has a race condition which potentially allows a process to change       its UID/EUID via suid or pkexec before authentication is completed.
  Impact :

    A local attacker could start a suid or pkexec process through a       polkit-enabled application, which could result in privilege escalation or       bypass of polkit restrictions.
  Workaround :

    There is no known workaround at this time.

Multiple security issues in systemd have been discovered by Sebastian Krahmer and Florian Weimer: Insecure interaction with DBUS could lead to the bypass of Policykit restrictions and privilege escalation or denial of service through an integer overflow in journald and missing input sanitising in the processing of X keyboard extension (XKB) files.

Updated polkit packages fix security vulnerability :

A race condition was found in the way the PolicyKit pkcheck utility checked process authorization when the process was specified by its process ID via the --process option. A local user could use this flaw to bypass intended PolicyKit authorizations and escalate their privileges (CVE-2013-4288).

Note: Applications that invoke pkcheck with the --process option need to be modified to use the pid,pid-start-time,uid argument for that option, to allow pkcheck to check process authorization correctly.

Because of the change in the PolicyKit API, hplip (CVE-2013-4325), rtkit (CVE-2013-4326), and systemd (CVE-2013-4327) packages have been updated to use a different API that is not affected by this PolicyKit vulnerability.

Fixes polkit authentication issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes polkit authentication issue. Updates the hardware database (including keyboard mappings) to the latest version from upstream.
Backport a bunch of fixes from upstream. Only a few correspond to bug reports, and others correct display issues, memory access, and correctness of operation.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that systemd was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
76271	GLSA-201406-27 : polkit, Spice-Gtk, systemd, HPLIP, libvirt: Privilege escalation	Nessus	Gentoo Local Security Checks	high
70402	Debian DSA-2777-1 : systemd - several vulnerabilities	Nessus	Debian Local Security Checks	high
70185	Mandriva Linux Security Advisory : polkit (MDVSA-2013:243)	Nessus	Mandriva Local Security Checks	high
70065	Fedora 18 : systemd-201-2.fc18.8 (2013-17203)	Nessus	Fedora Local Security Checks	medium
70064	Fedora 20 : systemd-207-4.fc20 (2013-17176)	Nessus	Fedora Local Security Checks	medium
70046	Fedora 19 : systemd-204-15.fc19 (2013-17119)	Nessus	Fedora Local Security Checks	medium
69979	Ubuntu 13.04 : systemd vulnerability (USN-1961-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2013-4327

high

Tenable Plugins

high

high

high

medium

medium

medium

medium