spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkit_unix_process_new API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2014-014:01 advisory.

    Client libraries for SPICE desktop servers.
    Security issues fixed with this release:
     CVE-2013-4324     spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure     polkit_unix_process_new API function, which allows local users to bypass intended access restrictions by     leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec     process, a related issue to CVE-2013-4288.
    Fixed bugs:
     Upgraded to upstream version 0.20, which provides a number of bug fixes and enhancements over the     previous version. Notable improvements are tunnelling through the HTTP proxy server, improved multi-     monitor support, and various USB redirection fixes.
     Tightened the dependencies so that spice-gtk cannot be installed unless the GTK+ and GLib versions it     requires are installed as well.
     Spice-gtk can now connect to a secure port y default, instead of always trying plain ports first.
     Previously, pressing Shift+CTRL+V on a message window in MS Outlook would crash the spice-gtk client.
    This has been fixed.
     Previously, on a MS Windows guest, the mouse pointer was not contrasted enough when put over a PuTTy     session. This has been fixed.
     Timeout has been reduced from 120 to 10 seconds when trying to connect to an unreachable host.
     Previously, spice-gtk Smartcard support stopped after migration or restarting a guest when it was already     initialized. The current workaround is to not disable software Smartcard support at spice-gtk connection     time if libcacard reports that software Smartcard support is already initialized.
    Enhancements:
     Added support for HTTP proxy server support in SPICE clients. The SPICE client nowconnects to the remote     server using the proxy server specified by the environment SPICE_PROXY=host:port variable, or by the     controller.
     When using copy and paste between Asianux Server Linux and Microsoft Windows, the end of line sequences     are translated into the target OS.
     Adjusted the adaptive video streaming settings to improve experience over low speed networks.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201406-27 (polkit, Spice-Gtk, systemd, HPLIP, libvirt: Privilege escalation)

    polkit has a race condition which potentially allows a process to change       its UID/EUID via suid or pkexec before authentication is completed.
  Impact :

    A local attacker could start a suid or pkexec process through a       polkit-enabled application, which could result in privilege escalation or       bypass of polkit restrictions.
  Workaround :

    There is no known workaround at this time.

spice-gtk received fixes for the acl helper policy kit checks that had a race condition in PID checking. (CVE-2013-4324, bnc#844967).

Fix CVE-2013-4324 Insecure calling of polkit via polkit_unix_process_new() Add a few upstream patches fixing bugs in spice-gtk 0.20

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

spice-gtk communicated with PolicyKit for authorization via an API that is vulnerable to a race condition. This could lead to intended PolicyKit authorizations being bypassed. This update modifies spice-gtk to communicate with PolicyKit via a different API that is not vulnerable to the race condition. (CVE-2013-4324)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:1273 advisory.

    The spice-gtk packages provide a GIMP Toolkit (GTK+) widget for SPICE     (Simple Protocol for Independent Computing Environments) clients. Both     Virtual Machine Manager and Virtual Machine Viewer can make use of this     widget to access virtual machines using the SPICE protocol.

    spice-gtk communicated with PolicyKit for authorization via an API that is     vulnerable to a race condition. This could lead to intended PolicyKit     authorizations being bypassed. This update modifies spice-gtk to     communicate with PolicyKit via a different API that is not vulnerable to     the race condition. (CVE-2013-4324)

    All users of spice-gtk are advised to upgrade to these updated packages,     which contain a backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1273 advisory.

    - New build with correct patch for CVE-2013-4324

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated spice-gtk packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The spice-gtk packages provide a GIMP Toolkit (GTK+) widget for SPICE (Simple Protocol for Independent Computing Environments) clients. Both Virtual Machine Manager and Virtual Machine Viewer can make use of this widget to access virtual machines using the SPICE protocol.

spice-gtk communicated with PolicyKit for authorization via an API that is vulnerable to a race condition. This could lead to intended PolicyKit authorizations being bypassed. This update modifies spice-gtk to communicate with PolicyKit via a different API that is not vulnerable to the race condition. (CVE-2013-4324)

All users of spice-gtk are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

ID	Name	Product	Family	Type	Severity
289137	MiracleLinux 4 : spice-gtk-0.20-11.AXS4 (AXSA:2014-014:01)	Nessus	Miracle Linux Local Security Checks	Local	high
76271	GLSA-201406-27 : polkit, Spice-Gtk, systemd, HPLIP, libvirt: Privilege escalation	Nessus	Gentoo Local Security Checks	Local	high
75172	openSUSE Security Update : spice-gtk (openSUSE-SU-2013:1562-1)	Nessus	SuSE Local Security Checks	Local	medium
70157	Fedora 19 : spice-gtk-0.20-6.fc19 (2013-17109)	Nessus	Fedora Local Security Checks	Local	medium
70017	Scientific Linux Security Update : spice-gtk on SL6.x i386/x86_64 (20130919)	Nessus	Scientific Linux Local Security Checks	Local	medium
70012	RHEL 6 : spice-gtk (RHSA-2013:1273)	Nessus	Red Hat Local Security Checks	Local	high
70008	Oracle Linux 6 : spice-gtk (ELSA-2013-1273)	Nessus	Oracle Linux Local Security Checks	Local	critical
70000	CentOS 6 : spice-gtk (CESA-2013:1273)	Nessus	CentOS Local Security Checks	Local	medium

Detections

Analytics

CVE-2013-4324

high

Tenable Plugins

high

high

medium

medium

medium

high

critical

medium