CVE-2011-1485 Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effect...
MediumCVSS 6.9
EPSS 5.2%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat policykit | = 0.96 | No fix listed |
| debian/policykit-1(Debian:12) | < 0.101-4 | 0.101-4 |
| debian/policykit-1(Debian:13) | < 0.101-4 | 0.101-4 |
| debian/policykit-1(Debian:14) | < 0.101-4 | 0.101-4 |
References
- Debian Security Tracker CVE-2011-1485 vendor-advisory
- bugs.debian.org issue-tracking
- FEDORA-2011-5589 patch vendor-advisory
- FEDORA-2011-5676 patch vendor-advisory
- 48817 third-party-advisory
- GLSA-201204-06 vendor-advisory
- 8424 third-party-advisory
- DSA-2319 vendor-advisory
- MDVSA-2011:086 vendor-advisory
- RHSA-2011:0455 vendor-advisory
- USN-1117-1 vendor-advisory
- bugzilla.redhat.com patch