CVE-2013-1065

backend.py in Jockey before 0.9.7-0ubuntu7.11 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Score

CVSS 2.0 4.6 Medium

Status

Modified - security@ubuntu.com

Published

2013-10-03

Last modified

2024-09-16

Weaknesses

CWE-264

Affected products

• Ubuntu Linux (Canonical)
• Jockey (Martin Pitt)

References

• http://secunia.com/advisories/54912
• http://www.ubuntu.com/usn/USN-1957-1
• https://launchpad.net/ubuntu/+source/jockey/0.9.7-0ubuntu7.11