cbcvebase.
CVE-2013-1062
published 2013-10-03

CVE-2013-1062: ubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1, and 0.2.2 before 0.2.2.1 does not properly use D-Bus for communication with a polkit…

PriorityP415medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EPSS
0.36%
28.5th percentile
ubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1, and 0.2.2 before 0.2.2.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Affected

6 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux——
canonicalubuntu_linux——
canonicalubuntu_linux——
michael_vogtubuntu-system-service——
michael_vogtubuntu-system-service——
michael_vogtubuntu-system-service——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.