spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkit_unix_process_new API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

The remote host is affected by the vulnerability described in GLSA-201406-27 (polkit, Spice-Gtk, systemd, HPLIP, libvirt: Privilege escalation)

    polkit has a race condition which potentially allows a process to change       its UID/EUID via suid or pkexec before authentication is completed.
  Impact :

    A local attacker could start a suid or pkexec process through a       polkit-enabled application, which could result in privilege escalation or       bypass of polkit restrictions.
  Workaround :

    There is no known workaround at this time.

spice-gtk received fixes for the acl helper policy kit checks that had a race condition in PID checking. (CVE-2013-4324, bnc#844967).

Fix CVE-2013-4324 Insecure calling of polkit via polkit_unix_process_new() Add a few upstream patches fixing bugs in spice-gtk 0.20

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

spice-gtk communicated with PolicyKit for authorization via an API that is vulnerable to a race condition. This could lead to intended PolicyKit authorizations being bypassed. This update modifies spice-gtk to communicate with PolicyKit via a different API that is not vulnerable to the race condition. (CVE-2013-4324)

Updated spice-gtk packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The spice-gtk packages provide a GIMP Toolkit (GTK+) widget for SPICE (Simple Protocol for Independent Computing Environments) clients. Both Virtual Machine Manager and Virtual Machine Viewer can make use of this widget to access virtual machines using the SPICE protocol.

spice-gtk communicated with PolicyKit for authorization via an API that is vulnerable to a race condition. This could lead to intended PolicyKit authorizations being bypassed. This update modifies spice-gtk to communicate with PolicyKit via a different API that is not vulnerable to the race condition. (CVE-2013-4324)

All users of spice-gtk are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

From Red Hat Security Advisory 2013:1273 :

Updated spice-gtk packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The spice-gtk packages provide a GIMP Toolkit (GTK+) widget for SPICE (Simple Protocol for Independent Computing Environments) clients. Both Virtual Machine Manager and Virtual Machine Viewer can make use of this widget to access virtual machines using the SPICE protocol.

spice-gtk communicated with PolicyKit for authorization via an API that is vulnerable to a race condition. This could lead to intended PolicyKit authorizations being bypassed. This update modifies spice-gtk to communicate with PolicyKit via a different API that is not vulnerable to the race condition. (CVE-2013-4324)

All users of spice-gtk are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

ID	Name	Product	Family	Severity
76271	GLSA-201406-27 : polkit, Spice-Gtk, systemd, HPLIP, libvirt: Privilege escalation	Nessus	Gentoo Local Security Checks	high
75172	openSUSE Security Update : spice-gtk (openSUSE-SU-2013:1562-1)	Nessus	SuSE Local Security Checks	medium
70157	Fedora 19 : spice-gtk-0.20-6.fc19 (2013-17109)	Nessus	Fedora Local Security Checks	medium
70017	Scientific Linux Security Update : spice-gtk on SL6.x i386/x86_64 (20130919)	Nessus	Scientific Linux Local Security Checks	medium
70012	RHEL 6 : spice-gtk (RHSA-2013:1273)	Nessus	Red Hat Local Security Checks	medium
70008	Oracle Linux 6 : spice-gtk (ELSA-2013-1273)	Nessus	Oracle Linux Local Security Checks	medium
70000	CentOS 6 : spice-gtk (CESA-2013:1273)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2013-4324

critical

Tenable Plugins

high

medium

medium

medium

medium

medium

medium