A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1135 advisory.

  - A flaw was found in polkit before version 0.116. The implementation of the     polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for     authentication and trigger authentication of unrelated processes owned by other users. This may result in     a local DoS and information disclosure. (CVE-2018-1116)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has polkit packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in polkit before version 0.116. The implementation of the     polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for     authentication and trigger authentication of unrelated processes owned by other users. This may result in     a local DoS and information disclosure. (CVE-2018-1116)

  - A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is     a setuid tool designed to allow unprivileged users to run commands as privileged users according     predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly     and ends trying to execute environment variables as commands. An attacker can leverage this by crafting     environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully     executed the attack can cause a local privilege escalation given unprivileged users administrative rights     on the target machine. (CVE-2021-4034)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has polkit packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in polkit before version 0.116. The implementation of the     polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for     authentication and trigger authentication of unrelated processes owned by other users. This may result in     a local DoS and information disclosure. (CVE-2018-1116)

  - A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is     a setuid tool designed to allow unprivileged users to run commands as privileged users according     predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly     and ends trying to execute environment variables as commands. An attacker can leverage this by crafting     environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully     executed the attack can cause a local privilege escalation given unprivileged users administrative rights     on the target machine. (CVE-2021-4034)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure. (CVE-2018-1116)

* polkit: Improper authorization in polkit_backend_interactive_authority_check_authorization function in polkitd

According to the versions of the polkit package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The polkit_backend_action_pool_init function in     polkitbackend/polkitbackendactionpool.c in PolicyKit     (aka polkit) before 0.113 might allow local users to     gain privileges via duplicate action IDs in action     descriptions.(CVE-2015-3255)

  - The authentication_agent_new function in     polkitbackend/polkitbackendinteractiveauthority.c in     PolicyKit (aka polkit) before 0.113 allows local users     to cause a denial of service (NULL pointer dereference     and polkitd daemon crash) by calling     RegisterAuthenticationAgent with an invalid object     path.(CVE-2015-3218)

  - A flaw was found in PolicyKit (aka polkit) 0.115 that     allows a user with a uid greater than INT_MAX to     successfully execute any systemctl     command.(CVE-2018-19788)

  - A flaw was found in polkit before version 0.116. The     implementation of the     polkit_backend_interactive_authority_check_authorizatio     n function in polkitd allows to test for authentication     and trigger authentication of unrelated processes owned     by other users. This may result in a local DoS and     information disclosure.(CVE-2018-1116)

  - Integer overflow in the authentication_agent_new_cookie     function in PolicyKit (aka polkit) before 0.113 allows     local users to gain privileges by creating a large     number of connections, which triggers the issuance of a     duplicate cookie value.(CVE-2015-4625)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1135 advisory.

  - polkit: Improper authorization in     polkit_backend_interactive_authority_check_authorization     function in polkitd (CVE-2018-1116)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1135 advisory.

  - polkit: Improper authorization in polkit_backend_interactive_authority_check_authorization function in     polkitd (CVE-2018-1116)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the polkit package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The polkit_backend_action_pool_init function in     polkitbackend/polkitbackendactionpool.c in PolicyKit     (aka polkit) before 0.113 might allow local users to     gain privileges via duplicate action IDs in action     descriptions.(CVE-2015-3255)

  - A NULL-pointer dereference flaw was discovered in     polkitd. A malicious, local user could exploit this     flaw to crash polkitd.(CVE-2015-3218)

  - A flaw was found in PolicyKit (aka polkit) 0.115 that     allows a user with a uid greater than INT_MAX to     successfully execute any systemctl     command.(CVE-2018-19788)

  - It was found that Polkit's CheckAuthorization and     RegisterAuthenticationAgent D-Bus calls did not     validate the client provided UID. A specially crafted     program could use this flaw to submit arbitrary UIDs,     triggering various denial of service or minor     disclosures, such as which authentication is cached in     the victim's session.(CVE-2018-1116)

  - Integer overflow in the authentication_agent_new_cookie     function in PolicyKit (aka polkit) before 0.113 allows     local users to gain privileges by creating a large     number of connections, which triggers the issuance of a     duplicate cookie value.(CVE-2015-4625)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in polkit before version 0.116. The     implementation of the     polkit_backend_interactive_authority_check_authorizatio     n function in polkitd allows to test for authentication     and trigger authentication of unrelated processes owned     by other users. This may result in a local DoS and     information disclosure.(CVE-2018-1116)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in polkit before version 0.116. The     implementation of the     polkit_backend_interactive_authority_check_authorizatio     n function in polkitd allows to test for authentication     and trigger authentication of unrelated processes owned     by other users. This may result in a local DoS and     information disclosure.(CVE-2018-1116)

  - Integer overflow in the authentication_agent_new_cookie     function in PolicyKit (aka polkit) before 0.113 allows     local users to gain privileges by creating a large     number of connections, which triggers the issuance of a     duplicate cookie value.(CVE-2015-4625)

  - The authentication_agent_new function in     polkitbackend/polkitbackendinteractiveauthority.c in     PolicyKit (aka polkit) before 0.113 allows local users     to cause a denial of service (NULL pointer dereference     and polkitd daemon crash) by calling     RegisterAuthenticationAgent with an invalid object     path.(CVE-2015-3218)

  - The polkit_backend_action_pool_init function in     polkitbackend/polkitbackendactionpool.c in PolicyKit     (aka polkit) before 0.113 might allow local users to     gain privileges via duplicate action IDs in action     descriptions.(CVE-2015-3255)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in polkit before version 0.116. The     implementation of the     polkit_backend_interactive_authority_check_authorizatio     n function in polkitd allows to test for authentication     and trigger authentication of unrelated processes owned     by other users. This may result in a local DoS and     information disclosure.(CVE-2018-1116)

  - The polkit_backend_action_pool_init function in     polkitbackend/polkitbackendactionpool.c in PolicyKit     (aka polkit) before 0.113 might allow local users to     gain privileges via duplicate action IDs in action     descriptions.(CVE-2015-3255)

  - The authentication_agent_new function in     polkitbackend/polkitbackendinteractiveauthority.c in     PolicyKit (aka polkit) before 0.113 allows local users     to cause a denial of service (NULL pointer dereference     and polkitd daemon crash) by calling     RegisterAuthenticationAgent with an invalid object     path.(CVE-2015-3218)

  - A flaw was found in PolicyKit (aka polkit) 0.115 that     allows a user with a uid greater than INT_MAX to     successfully execute any systemctl     command.(CVE-2018-19788)

  - Integer overflow in the authentication_agent_new_cookie     function in PolicyKit (aka polkit) before 0.113 allows     local users to gain privileges by creating a large     number of connections, which triggers the issuance of a     duplicate cookie value.(CVE-2015-4625)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201908-14 (polkit: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in polkit. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for polkit fixes the following issues :

Security issue fixed :

  - CVE-2018-1116: Fix uid comparison lacking in     polkit_backend_interactive_authority_check_authorization     (bsc#1099031).

This update was imported from the SUSE:SLE-15:Update update project.

Security fix for CVE-2018-1116.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for polkit fixes the following issues: Security issue fixed :

  - CVE-2018-1116: Fix uid comparison lacking in     polkit_backend_interactive_authority_check_authorization     (bsc#1099031).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a denial of service vulnerability in policykit-1, a framework for managing administrative policies and privileges.

For Debian 8 'Jessie', this issue has been fixed in policykit-1 version 0.105-15~deb8u3.

We recommend that you upgrade your policykit-1 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for polkit fixes the following issues :

  - CVE-2018-1116: Fixed trusting the client-supplied UID     which could lead to a denial of service (too many     dialogs) caused by local attackers (boo#1099031)

Tavis Ormandy discovered that PolicyKit incorrectly handled certain invalid object paths. A local attacker could possibly use this issue to cause PolicyKit to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-3218)

It was discovered that PolicyKit incorrectly handled certain duplicate action IDs. A local attacker could use this issue to cause PolicyKit to crash, resulting in a denial of service, or possibly escalate privileges. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-3255)

Tavis Ormandy discovered that PolicyKit incorrectly handled duplicate cookie values. A local attacker could use this issue to cause PolicyKit to crash, resulting in a denial of service, or possibly escalate privileges. This issue only affected Ubuntu 14.04 LTS.
(CVE-2015-4625)

Matthias Gerstner discovered that PolicyKit incorrectly checked users.
A local attacker could possibly use this issue to cause authentication dialogs to show up for other users, leading to a denial of service or an information leak. (CVE-2018-1116).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
180735	Oracle Linux 7 : polkit (ELSA-2020-1135)	Nessus	Oracle Linux Local Security Checks	medium
174078	NewStart CGSL CORE 5.05 / MAIN 5.05 : polkit Multiple Vulnerabilities (NS-SA-2023-0027)	Nessus	NewStart CGSL Local Security Checks	high
164612	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17.1)	Nessus	Misc.	critical
164596	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.3)	Nessus	Misc.	critical
164595	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.18)	Nessus	Misc.	critical
160791	NewStart CGSL CORE 5.04 / MAIN 5.04 : polkit Multiple Vulnerabilities (NS-SA-2022-0022)	Nessus	NewStart CGSL Local Security Checks	high
137568	Amazon Linux 2 : polkit (ALAS-2020-1437)	Nessus	Amazon Linux Local Security Checks	medium
135828	Scientific Linux Security Update : polkit on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	medium
135625	EulerOS Virtualization 3.0.2.2 : polkit (EulerOS-SA-2020-1463)	Nessus	Huawei Local Security Checks	high
135345	CentOS 7 : polkit (CESA-2020:1135)	Nessus	CentOS Local Security Checks	medium
135060	RHEL 7 : polkit (RHSA-2020:1135)	Nessus	Red Hat Local Security Checks	medium
134482	EulerOS Virtualization for ARM 64 3.0.2.0 : polkit (EulerOS-SA-2020-1193)	Nessus	Huawei Local Security Checks	high
132186	EulerOS 2.0 SP3 : polkit (EulerOS-SA-2019-2651)	Nessus	Huawei Local Security Checks	medium
131896	EulerOS 2.0 SP2 : polkit (EulerOS-SA-2019-2404)	Nessus	Huawei Local Security Checks	medium
130685	EulerOS 2.0 SP5 : polkit (EulerOS-SA-2019-2223)	Nessus	Huawei Local Security Checks	high
127963	GLSA-201908-14 : polkit: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
123251	openSUSE Security Update : polkit (openSUSE-2019-579)	Nessus	SuSE Local Security Checks	medium
120939	Fedora 28 : polkit (2018-fef8a691a6)	Nessus	Fedora Local Security Checks	medium
120069	SUSE SLED15 / SLES15 Security Update : polkit (SUSE-SU-2018:2165-1)	Nessus	SuSE Local Security Checks	medium
111629	openSUSE Security Update : polkit (openSUSE-2018-848)	Nessus	SuSE Local Security Checks	high
111509	SUSE SLED12 / SLES12 Security Update : polkit (SUSE-SU-2018:2163-1)	Nessus	SuSE Local Security Checks	medium
111471	Fedora 27 : polkit (2018-83df5dc658)	Nessus	Fedora Local Security Checks	medium
111389	Debian DLA-1448-1 : policykit-1 security update	Nessus	Debian Local Security Checks	medium
111193	openSUSE Security Update : polkit (openSUSE-2018-735)	Nessus	SuSE Local Security Checks	medium
111135	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : PolicyKit vulnerabilities (USN-3717-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2018-1116

medium

Tenable Plugins

medium

high

critical

critical

critical

high

medium

medium

high

medium

medium

high

medium

medium

high

high

medium

medium

medium

high

medium

medium

medium

medium

medium