Strix
26.1K

CVE-2013-1061

UnknownEPSS 0.36%

Last modified

CVE-2013-1061 is a vulnerability of currently unknown severity. dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.. EPSS estimates a 0.36% chance of exploitation in the next 30 days.

Description

dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Metrics

EPSS Probability
0.36%

27.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Marc DeslauriersSoftware-Properties0.82.7
Marc DeslauriersSoftware-Properties0.82.7.1
Marc DeslauriersSoftware-Properties0.82.7.2
Marc DeslauriersSoftware-Properties0.82.7.3
Marc DeslauriersSoftware-Properties0.82.7.4
Marc DeslauriersSoftware-Properties0.92.9
Marc DeslauriersSoftware-Properties0.92.9.1
Marc DeslauriersSoftware-Properties0.92.9.2
Marc DeslauriersSoftware-Properties0.92.17
Marc DeslauriersSoftware-Properties0.92.17.1
Marc DeslauriersSoftware-Properties0.92.17.2
CanonicalUbuntu Linux12.04
CanonicalUbuntu Linux12.10
CanonicalUbuntu Linux13.04

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2013-1061?
dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
How severe is CVE-2013-1061?
Severity scoring for CVE-2013-1061 is pending analysis. The EPSS model estimates a 0.36% probability of exploitation in the next 30 days.
How do I fix CVE-2013-1061?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2013-1061?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST