pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - polkit: Improper handling of user with uid > INT_MAX leading to authentication bypass (CVE-2018-19788)

  - The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka     polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action     descriptions. (CVE-2015-3255)

  - Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113     allows local users to gain privileges by creating a large number of connections, which triggers the     issuance of a duplicate cookie value. (CVE-2015-4625)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - polkit: potential information disclosure vulnerability due to cookie counter wrapping (CVE-2015-4625)

  - polkit: Program run via pkexec as unprivileged user can escape to parent session via TIOCSTI ioctl     (CVE-2016-2568)

  - The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit     (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and     polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path. (CVE-2015-3218)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

ID	Name	Product	Family	Severity
199781	RHEL 6 : polkit (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199778	RHEL 7 : polkit (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195836	RHEL 7 : polkit (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195798	RHEL 6 : polkit (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2016-2568

high

Tenable Plugins

high

high

high

high