Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in polkit
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in polkit
ID: MDVSA-2013:243
Distribution: Mandriva
Plattformen: Mandriva Business Server 1.0
Datum: Fr, 27. September 2013, 14:41
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4288
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4325
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4326
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4327
https://bugs.mageia.org/show_bug.cgi?id=11260
Applikationen: policykit

Originalnachricht

This is a multi-part message in MIME format...

------------=_1380285021-3327-3

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:243
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : polkit
Date : September 27, 2013
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated polkit packages fix security vulnerability:

A race condition was found in the way the PolicyKit pkcheck utility
checked process authorization when the process was specified by its
process ID via the --process option. A local user could use this
flaw to bypass intended PolicyKit authorizations and escalate their
privileges (CVE-2013-4288).

Note: Applications that invoke pkcheck with the --process option need
to be modified to use the pid,pid-start-time,uid argument for that
option, to allow pkcheck to check process authorization correctly.

Because of the change in the PolicyKit API, hplip (CVE-2013-4325),
rtkit (CVE-2013-4326), and systemd (CVE-2013-4327) packages have
been updated to use a different API that is not affected by this
PolicyKit vulnerability.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4288
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4325
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4326
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4327
https://bugs.mageia.org/show_bug.cgi?id=11260
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
a505f84a730fe73329a47e34c63a7dbe mbs1/x86_64/hplip-3.12.4-1.1.mbs1.x86_64.rpm
3a4ba0c6f598df5d0a895e92d86bdee6
mbs1/x86_64/hplip-doc-3.12.4-1.1.mbs1.x86_64.rpm
5ff79b31c0d10f328cb3a33e73ee443f
mbs1/x86_64/hplip-hpijs-3.12.4-1.1.mbs1.x86_64.rpm
06ad03c60671fdc268f68c19abccdead
mbs1/x86_64/hplip-hpijs-ppds-3.12.4-1.1.mbs1.x86_64.rpm
464c910aa533f8a8bb2f2c3022127339
mbs1/x86_64/hplip-model-data-3.12.4-1.1.mbs1.x86_64.rpm
c868787d3990ecfdae81124e449b9fe5
mbs1/x86_64/lib64hpip0-3.12.4-1.1.mbs1.x86_64.rpm
16b802096b39e33c3c2e048e5034f6ee
mbs1/x86_64/lib64hpip0-devel-3.12.4-1.1.mbs1.x86_64.rpm
d9832f1d43a46d48de126d112744a63f
mbs1/x86_64/lib64polkit1_0-0.104-6.1.mbs1.x86_64.rpm
7cb376fc2241b8ef5d9fec5d56f8b44e
mbs1/x86_64/lib64polkit1-devel-0.104-6.1.mbs1.x86_64.rpm
6bd18537f831797178c8d8797ddb38c8
mbs1/x86_64/lib64polkit-gir1.0-0.104-6.1.mbs1.x86_64.rpm
bf1d4dfcde5c3268d93d3410686390cf
mbs1/x86_64/lib64sane-hpaio1-3.12.4-1.1.mbs1.x86_64.rpm
03c53c95ae85aa80d715eba6cb0a568e
mbs1/x86_64/lib64systemd-daemon0-44-16.1.mbs1.x86_64.rpm
3d652b24d8237db4354232c58da626f7
mbs1/x86_64/lib64systemd-daemon0-devel-44-16.1.mbs1.x86_64.rpm
720ca216bd163136e6157fae2ce3a8ce
mbs1/x86_64/lib64systemd-id1280-44-16.1.mbs1.x86_64.rpm
3dec561fc60e5670f775759d279b73f9
mbs1/x86_64/lib64systemd-id1280-devel-44-16.1.mbs1.x86_64.rpm
a5f09de0fe35f59d4f03c44d60706fc8
mbs1/x86_64/lib64systemd-journal0-44-16.1.mbs1.x86_64.rpm
1aa5d342f5e1ea17ad23a3adcb846b67
mbs1/x86_64/lib64systemd-journal0-devel-44-16.1.mbs1.x86_64.rpm
989d00585eda3757067bd7757760d21f
mbs1/x86_64/lib64systemd-login0-44-16.1.mbs1.x86_64.rpm
a64fbbeaf21c77c50bda1fff4278a34c
mbs1/x86_64/lib64systemd-login0-devel-44-16.1.mbs1.x86_64.rpm
03ba458caeb642419984d0984ea156b9 mbs1/x86_64/polkit-0.104-6.1.mbs1.x86_64.rpm
f58526b0a6b7dd710d6ae50c401f3ca1
mbs1/x86_64/polkit-desktop-policy-0.104-6.1.mbs1.noarch.rpm
535391c9d869772e68cd13adac519113 mbs1/x86_64/rtkit-0.10-3.1.mbs1.x86_64.rpm
867308654e786d01f4c66054cca07ab5 mbs1/x86_64/systemd-44-16.1.mbs1.x86_64.rpm
52e155e8f9d39745da50bd8bcea8cd54
mbs1/x86_64/systemd-sysvinit-44-16.1.mbs1.x86_64.rpm
f71f9b8a5f1676bc3af636e510f9c7a8
mbs1/x86_64/systemd-tools-44-16.1.mbs1.x86_64.rpm
959a6d57120d110fc44178581105eb55
mbs1/x86_64/systemd-units-44-16.1.mbs1.x86_64.rpm
119ee4665dda5c72402c2fdf7d6c5298 mbs1/SRPMS/hplip-3.12.4-1.1.mbs1.src.rpm
f78ac8cf2fc3c60849ae806c1de0c4dd mbs1/SRPMS/polkit-0.104-6.1.mbs1.src.rpm
0af0c0abd85fc991c6592365cc93dd6e mbs1/SRPMS/rtkit-0.10-3.1.mbs1.src.rpm
3ac52aac654aaf3f3fefde1207e827e4 mbs1/SRPMS/systemd-44-16.1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFSRU8kmqjQ0CJFipgRAkXbAJ9iPmTMQKsKPm+OWXqRInATopCCmwCfRdXV
kMysjzhFrsiR+UU4aedRnfM=
=1TYz
-----END PGP SIGNATURE-----


------------=_1380285021-3327-3
Content-Type: text/plain; charset="UTF-8";
name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________


------------=_1380285021-3327-3--
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung