PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation."

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-089:01 advisory.

    polkit is a toolkit for defining and handling authorizations.  It is     used for allowing unprivileged processes to speak to privileged     processes.
    Security issues fixed with this release:
    CVE-2015-3256     PolicyKit (aka polkit) before 0.113 allows local users to cause a     denial of service (memory corruption and polkitd daemon crash) and     possibly gain privileges via unspecified vectors, related to     javascript rule evaluation.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A denial of service flaw was found in how polkit handled authorization requests. A local, unprivileged user could send malicious requests to polkit, which could then cause the polkit daemon to corrupt its memory and crash. (CVE-2015-3256)

The system must be rebooted for this update to take effect.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:0189 advisory.

    PolicyKit is a toolkit for defining and handling authorizations.

    A denial of service flaw was found in how polkit handled authorization     requests. A local, unprivileged user could send malicious requests to     polkit, which could then cause the polkit daemon to corrupt its memory and     crash. (CVE-2015-3256)

    All polkit users should upgrade to these updated packages, which contain a     backported patch to correct this issue. The system must be rebooted for     this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-0189 advisory.

    [0.112-6]
    - Fix CVE-2015-3256       Resolves: #1271790

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated polkit packages that fix one security issue are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

PolicyKit is a toolkit for defining and handling authorizations.

A denial of service flaw was found in how polkit handled authorization requests. A local, unprivileged user could send malicious requests to polkit, which could then cause the polkit daemon to corrupt its memory and crash. (CVE-2015-3256)

All polkit users should upgrade to these updated packages, which contain a backported patch to correct this issue. The system must be rebooted for this update to take effect.

Colin Walters reports :

- Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.

- The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path.

- The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions.

- PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to 'javascript rule evaluation.'

polkit was updated to the 0.113 release, fixing security issues and bugs.

Security issues fixed :

  - Fixes CVE-2015-4625, a local privilege escalation due to     predictable authentication session cookie values. Thanks     to Tavis Ormandy, Google Project Zero for reporting this     issue. For the future, authentication agents are     encouraged to use PolkitAgentSession instead of using     the D-Bus agent response API directly. (bsc#935119)

  - Fixes CVE-2015-3256, various memory corruption     vulnerabilities in use of the JavaScript interpreter,     possibly leading to local privilege escalation.
    (bsc#943816)

  - Fixes CVE-2015-3255, a memory corruption vulnerability     in handling duplicate action IDs, possibly leading to     local privilege escalation. Thanks to Laurent Bigonville     for reporting this issue. (bsc#939246)

  - Fixes CVE-2015-3218, which allowed any local user to     crash polkitd. Thanks to Tavis Ormandy, Google Project     Zero, for reporting this issue. (bsc#933922)

Other issues fixed :

  - On systemd-213 and later, the 'active' state is shared     across all sessions of an user, instead of being tracked     separately.

  - pkexec, when not given a program to execute, runs the     users shell by default.

  - Fixed shutdown problems on powerpc64le (bsc#950114)

  - polkit had a memory leak (bsc#912889)

polkit was updated to the 0.113 release, fixing security issues and bugs.

Security issues fixed :

  - Fixes CVE-2015-4625, a local privilege escalation due to     predictable authentication session cookie values. Thanks     to Tavis Ormandy, Google Project Zero for reporting this     issue. For the future, authentication agents are     encouraged to use PolkitAgentSession instead of using     the D-Bus agent response API directly. (bsc#935119)

  - Fixes CVE-2015-3256, various memory corruption     vulnerabilities in use of the JavaScript interpreter,     possibly leading to local privilege escalation.
    (bsc#943816)

  - Fixes CVE-2015-3255, a memory corruption vulnerability     in handling duplicate action IDs, possibly leading to     local privilege escalation. Thanks to Laurent Bigonville     for reporting this issue. (bsc#939246)

  - Fixes CVE-2015-3218, which allowed any local user to     crash polkitd. Thanks to Tavis Ormandy, Google Project     Zero, for reporting this issue. (bsc#933922)

Other issues fixed :

  - On systemd-213 and later, the 'active' state is shared     across all sessions of an user, instead of being tracked     separately.

  - pkexec, when not given a program to execute, runs the     users shell by default.

  - Fixed shutdown problems on powerpc64le (bsc#950114)

  - polkit had a memory leak (bsc#912889)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Polkit was updated to 0.113 to fix four security issues.

The following vulnerabilities were fixed :

  - CVE-2015-4625: a local privilege escalation due to     predictable authentication session cookie values.
    (boo#935119)

  - CVE-2015-3256: various memory corruption vulnerabilities     in use of the JavaScript interpreter, possibly leading     to local privilege escalation. (boo#943816)

  - CVE-2015-3255: a memory corruption vulnerability in     handling duplicate action IDs, possibly leading to local     privilege escalation. (boo#939246)

  - CVE-2015-3218: Allowed any local user to crash polkitd.
    (boo#933922)

Security fix for CVE-2015-3218, CVE-2015-3255, CVE-2015-3256, CVE-2015-4625

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
289895	MiracleLinux 7 : polkit-0.112-6.el7 (AXSA:2016-089:01)	Nessus	Miracle Linux Local Security Checks	Local	high
88800	Scientific Linux Security Update : polkit on SL7.x x86_64 (20160216)	Nessus	Scientific Linux Local Security Checks	Local	medium
88788	RHEL 7 : polkit (RHSA-2016:0189)	Nessus	Red Hat Local Security Checks	Local	high
88780	Oracle Linux 7 : polkit (ELSA-2016-0189)	Nessus	Oracle Linux Local Security Checks	Local	high
88761	CentOS 7 : polkit (CESA-2016:0189)	Nessus	CentOS Local Security Checks	Local	medium
87831	FreeBSD : polkit -- multiple vulnerabilities (631fc042-b636-11e5-83ef-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	Local	medium
86957	openSUSE Security Update : polkit (openSUSE-2015-711)	Nessus	SuSE Local Security Checks	Local	medium
86649	SUSE SLED12 / SLES12 Security Update : polkit (SUSE-SU-2015:1838-1)	Nessus	SuSE Local Security Checks	Local	medium
86390	openSUSE Security Update : polkit (openSUSE-2015-655)	Nessus	SuSE Local Security Checks	Local	medium
84686	Fedora 22 : polkit-0.113-1.fc22 (2015-11058)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2015-3256

high

Tenable Plugins

high

medium

high

high

medium

medium

medium

medium

medium

medium