CVE-2013-1062
ubuntu-system-service 0.2.2-0.2.4 - Local Privilege Escalation via PolkitUnixProcess Race Condition
Title source: llmDescription
ubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1, and 0.2.2 before 0.2.2.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1962-1
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/54907
Scores
EPSS
0.0036
EPSS Percentile
28.1%
Details
CWE
CWE-264
Status
published
Products (6)
canonical/ubuntu_linux
12.04
canonical/ubuntu_linux
12.10
canonical/ubuntu_linux
13.04
michael_vogt/ubuntu-system-service
0.2.2
michael_vogt/ubuntu-system-service
0.2.3
michael_vogt/ubuntu-system-service
0.2.4
Published
Oct 03, 2013
Tracked Since
Feb 18, 2026