CVE-2014-5033 KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a Polk...
MediumCVSS 6.9
EPSS 0.36%
- Published
- Updated
- Exploit status
- No public exploit known
Description
KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/kde4libs | All versions | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| KDE kauth | <= 5.0 | No fix listed |
| kdelibs | <= 4.13.97 | No fix listed |
| kdelibs | = 4.10.0 | No fix listed |
| kdelibs | = 4.10.1 | No fix listed |
| kdelibs | = 4.10.2 | No fix listed |
| kdelibs | = 4.10.3 | No fix listed |
| kdelibs | = 4.10.95 | No fix listed |
| kdelibs | = 4.10.97 | No fix listed |
| kdelibs | = 4.11.0 | No fix listed |
| kdelibs | = 4.11.1 | No fix listed |
| kdelibs | = 4.11.2 | No fix listed |
| kdelibs | = 4.11.3 | No fix listed |
| kdelibs | = 4.11.4 | No fix listed |
| kdelibs | = 4.11.5 | No fix listed |
| kdelibs | = 4.11.80 | No fix listed |
| kdelibs | = 4.11.90 | No fix listed |
| kdelibs | = 4.11.95 | No fix listed |
| kdelibs | = 4.11.97 | No fix listed |
| kdelibs | = 4.12.0 | No fix listed |
| kdelibs | = 4.12.1 | No fix listed |
| kdelibs | = 4.12.2 | No fix listed |
| kdelibs | = 4.12.3 | No fix listed |
Show 13 more
| Product | Affected versions | Fixed in |
|---|---|---|
| kdelibs | = 4.12.4 | No fix listed |
| kdelibs | = 4.12.5 | No fix listed |
| kdelibs | = 4.12.80 | No fix listed |
| kdelibs | = 4.12.90 | No fix listed |
| kdelibs | = 4.12.95 | No fix listed |
| kdelibs | = 4.12.97 | No fix listed |
| kdelibs | = 4.13.0 | No fix listed |
| kdelibs | = 4.13.1 | No fix listed |
| kdelibs | = 4.13.2 | No fix listed |
| kdelibs | = 4.13.3 | No fix listed |
| kdelibs | = 4.13.80 | No fix listed |
| kdelibs | = 4.13.90 | No fix listed |
| kdelibs | = 4.13.95 | No fix listed |
References
- openSUSE-SU-2014:0981 vendor-advisory
- quickgit.kde.org
- quickgit.kde.org exploit patch
- RHSA-2014:1359 vendor-advisory
- 60385 third-party-advisory
- 60633 third-party-advisory
- 60654 third-party-advisory
- DSA-3004 vendor-advisory
- www.kde.org vendor-advisory
- USN-2304-1 vendor-advisory