CVE-2011-4945 PolicyKit 0.103 sets the AdminIdentities to "wheel" by default, which allows local users in the wheel group to gain root privileges without authentication.
MediumCVSS 6.9
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PolicyKit 0.103 sets the AdminIdentities to "wheel" by default, which allows local users in the wheel group to gain root privileges without authentication.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/policykit-1(Debian:12) | < 0.103-1 | 0.103-1 |
| debian/policykit-1(Debian:13) | < 0.103-1 | 0.103-1 |
| debian/policykit-1(Debian:14) | < 0.103-1 | 0.103-1 |
| michael biebl policykit | = 0.103 | No fix listed |
References
- Debian Security Tracker CVE-2011-4945 vendor-advisory
- cgit.freedesktop.org
- patch-tracker.debian.org
- 48817 third-party-advisory
- GLSA-201204-06 vendor-advisory
- [polkit-devel] 20111206 polkit 0.103 mailing-list
- [oss-security] 20120327 CVE Request: PolicyKit change allows users in "wheel" group to become root without a password mailing-list
- [oss-security] 20120327 Re: CVE Request: PolicyKit change allows users in "wheel" group to become root without a password mailing-list
- bugs.gentoo.org
- launchpad.net