Tavis Ormandy氏は、PolicyKitが特定の無効なオブジェクトパスを不適切に処理することを発見しました。ローカルの攻撃者がこの問題を悪用して、PolicyKitをクラッシュさせて、サービス拒否を引き起こす可能性があります。この問題の影響を受けるのは、Ubuntu 14.04 LTSのみです。(CVE-2015-3218) 

PolicyKitが特定の重複したアクションIDを不適切に処理することが発見されました。ローカルの攻撃者がこの問題を悪用して、PolicyKitをクラッシュさせ、サービス拒否を引き起こしたり、権限を昇格させたりする可能性があります。この問題の影響を受けるのは、Ubuntu 14.04 LTSのみです。(CVE-2015-3255) 

Tavis Ormandy氏は、PolicyKitが重複するCookie値を不適切に処理することを発見しました。ローカルの攻撃者がこの問題を悪用して、PolicyKitをクラッシュさせ、サービス拒否を引き起こしたり、権限を昇格させたりする可能性があります。この問題の影響を受けるのは、Ubuntu 14.04 LTSのみです。
(CVE-2015-4625)

Matthias Gerstner氏は、PolicyKitが不適切にユーザーをチェックすることを発見しました。
ローカルの攻撃者がこの問題を悪用して、認証ダイアローグを他のユーザーに表示させ、サービス拒否や情報漏えいを引き起こす可能性があります。(CVE-2018-1116)。

注意: Tenable Network Security は、前述の説明ブロックを Ubuntu セキュリティアドバイザリからすでに直接抽出しています。Tenable では、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

Security fix for CVE-2018-1116.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was a denial of service vulnerability in policykit-1, a framework for managing administrative policies and privileges.

For Debian 8 'Jessie', this issue has been fixed in policykit-1 version 0.105-15~deb8u3.

We recommend that you upgrade your policykit-1 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for polkit fixes the following issues: Security issue fixed :

  - CVE-2018-1116: Fix uid comparison lacking in     polkit_backend_interactive_authority_check_authorization     (bsc#1099031).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1135 advisory.

    - Refined upstream fix of CVE-2018-1116 to avoid ABI changes
    - fix of CVE-2018-1116

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.18. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.18 advisory.

  - When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to     Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP     connection. If such connections are available to an attacker, they can be exploited in ways that may be     surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped     with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected     (and recommended in the security guide) that this Connector would be disabled if not required. This     vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the     web application - processing any file in the web application as a JSP Further, if the web application     allowed file upload and stored those files within the web application (or the attacker was able to control     the content of the web application by some other means) then this, along with the ability to process a     file as a JSP, made remote code execution possible. It is important to note that mitigation is only     required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth     approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to     Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP     Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading     to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
    (CVE-2020-1938)

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where,     the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error     occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by     the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
    (CVE-2019-19338)

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
    (CVE-2015-8035)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3717-1 advisory.

    Tavis Ormandy discovered that PolicyKit incorrectly handled certain invalid object paths. A local attacker     could possibly use this issue to cause PolicyKit to crash, resulting in a denial of service. This issue     only affected Ubuntu 14.04 LTS. (CVE-2015-3218)

    It was discovered that PolicyKit incorrectly handled certain duplicate action IDs. A local attacker could     use this issue to cause PolicyKit to crash, resulting in a denial of service, or possibly escalate     privileges. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-3255)

    Tavis Ormandy discovered that PolicyKit incorrectly handled duplicate cookie values. A local attacker     could use this issue to cause PolicyKit to crash, resulting in a denial of service, or possibly escalate     privileges. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-4625)

    Matthias Gerstner discovered that PolicyKit incorrectly checked users. A local attacker could possibly use     this issue to cause authentication dialogs to show up for other users, leading to a denial of service or     an information leak. (CVE-2018-1116)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the polkit package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The polkit_backend_action_pool_init function in     polkitbackend/polkitbackendactionpool.c in PolicyKit     (aka polkit) before 0.113 might allow local users to     gain privileges via duplicate action IDs in action     descriptions.(CVE-2015-3255)

  - A NULL-pointer dereference flaw was discovered in     polkitd. A malicious, local user could exploit this     flaw to crash polkitd.(CVE-2015-3218)

  - A flaw was found in PolicyKit (aka polkit) 0.115 that     allows a user with a uid greater than INT_MAX to     successfully execute any systemctl     command.(CVE-2018-19788)

  - It was found that Polkit's CheckAuthorization and     RegisterAuthenticationAgent D-Bus calls did not     validate the client provided UID. A specially crafted     program could use this flaw to submit arbitrary UIDs,     triggering various denial of service or minor     disclosures, such as which authentication is cached in     the victim's session.(CVE-2018-1116)

  - Integer overflow in the authentication_agent_new_cookie     function in PolicyKit (aka polkit) before 0.113 allows     local users to gain privileges by creating a large     number of connections, which triggers the issuance of a     duplicate cookie value.(CVE-2015-4625)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for polkit fixes the following issues :

Security issue fixed :

  - CVE-2018-1116: Fix uid comparison lacking in     polkit_backend_interactive_authority_check_authorization     (bsc#1099031).

This update was imported from the SUSE:SLE-15:Update update project.

An update of the polkit package has been released.

The version of polkit installed on the remote host is prior to 0.112-26. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1437 advisory.

    A flaw was found in polkit before version 0.116. The implementation of the     polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for     authentication and trigger authentication of unrelated processes owned by other users. This may result in     a local DoS and information disclosure. (CVE-2018-1116)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in polkit before version 0.116. The     implementation of the     polkit_backend_interactive_authority_check_authorizatio     n function in polkitd allows to test for authentication     and trigger authentication of unrelated processes owned     by other users. This may result in a local DoS and     information disclosure.(CVE-2018-1116)

  - The polkit_backend_action_pool_init function in     polkitbackend/polkitbackendactionpool.c in PolicyKit     (aka polkit) before 0.113 might allow local users to     gain privileges via duplicate action IDs in action     descriptions.(CVE-2015-3255)

  - The authentication_agent_new function in     polkitbackend/polkitbackendinteractiveauthority.c in     PolicyKit (aka polkit) before 0.113 allows local users     to cause a denial of service (NULL pointer dereference     and polkitd daemon crash) by calling     RegisterAuthenticationAgent with an invalid object     path.(CVE-2015-3218)

  - A flaw was found in PolicyKit (aka polkit) 0.115 that     allows a user with a uid greater than INT_MAX to     successfully execute any systemctl     command.(CVE-2018-19788)

  - Integer overflow in the authentication_agent_new_cookie     function in PolicyKit (aka polkit) before 0.113 allows     local users to gain privileges by creating a large     number of connections, which triggers the issuance of a     duplicate cookie value.(CVE-2015-4625)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the polkit package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The polkit_backend_action_pool_init function in     polkitbackend/polkitbackendactionpool.c in PolicyKit     (aka polkit) before 0.113 might allow local users to     gain privileges via duplicate action IDs in action     descriptions.(CVE-2015-3255)

  - The authentication_agent_new function in     polkitbackend/polkitbackendinteractiveauthority.c in     PolicyKit (aka polkit) before 0.113 allows local users     to cause a denial of service (NULL pointer dereference     and polkitd daemon crash) by calling     RegisterAuthenticationAgent with an invalid object     path.(CVE-2015-3218)

  - A flaw was found in PolicyKit (aka polkit) 0.115 that     allows a user with a uid greater than INT_MAX to     successfully execute any systemctl     command.(CVE-2018-19788)

  - A flaw was found in polkit before version 0.116. The     implementation of the     polkit_backend_interactive_authority_check_authorizatio     n function in polkitd allows to test for authentication     and trigger authentication of unrelated processes owned     by other users. This may result in a local DoS and     information disclosure.(CVE-2018-1116)

  - Integer overflow in the authentication_agent_new_cookie     function in PolicyKit (aka polkit) before 0.113 allows     local users to gain privileges by creating a large     number of connections, which triggers the issuance of a     duplicate cookie value.(CVE-2015-4625)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has polkit packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in polkit before version 0.116. The implementation of the     polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for     authentication and trigger authentication of unrelated processes owned by other users. This may result in     a local DoS and information disclosure. (CVE-2018-1116)

  - A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is     a setuid tool designed to allow unprivileged users to run commands as privileged users according     predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly     and ends trying to execute environment variables as commands. An attacker can leverage this by crafting     environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully     executed the attack can cause a local privilege escalation given unprivileged users administrative rights     on the target machine. (CVE-2021-4034)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has polkit packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in polkit before version 0.116. The implementation of the     polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for     authentication and trigger authentication of unrelated processes owned by other users. This may result in     a local DoS and information disclosure. (CVE-2018-1116)

  - A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is     a setuid tool designed to allow unprivileged users to run commands as privileged users according     predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly     and ends trying to execute environment variables as commands. An attacker can leverage this by crafting     environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully     executed the attack can cause a local privilege escalation given unprivileged users administrative rights     on the target machine. (CVE-2021-4034)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
111135	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : PolicyKitの脆弱性 (USN-3717-1)	Nessus	Ubuntu Local Security Checks	2018/7/17	2025/9/3	medium
120939	Fedora 28 : polkit (2018-fef8a691a6)	Nessus	Fedora Local Security Checks	2019/1/3	2021/1/6	medium
111389	Debian DLA-1448-1 : policykit-1 security update	Nessus	Debian Local Security Checks	2018/7/30	2024/9/2	medium
111509	SUSE SLED12 / SLES12 Security Update : polkit (SUSE-SU-2018:2163-1)	Nessus	SuSE Local Security Checks	2018/8/2	2024/8/27	medium
180735	Oracle Linux 7 : polkit (ELSA-2020-1135)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	medium
164595	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.18)	Nessus	Misc.	2022/9/1	2025/9/1	critical
111135	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : PolicyKit vulnerabilities (USN-3717-1)	Nessus	Ubuntu Local Security Checks	2018/7/17	2025/9/3	medium
134482	EulerOS Virtualization for ARM 64 3.0.2.0 : polkit (EulerOS-SA-2020-1193)	Nessus	Huawei Local Security Checks	2020/3/13	2024/3/22	high
111629	openSUSE Security Update : polkit (openSUSE-2018-848)	Nessus	SuSE Local Security Checks	2018/8/10	2024/8/22	medium
123251	openSUSE Security Update : polkit (openSUSE-2019-579)	Nessus	SuSE Local Security Checks	2019/3/27	2021/1/19	medium
120069	SUSE SLED15 / SLES15 Security Update : polkit (SUSE-SU-2018:2165-1)	Nessus	SuSE Local Security Checks	2019/1/2	2020/5/11	medium
203076	Photon OS 3.0: Polkit PHSA-2019-3.0-0036	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/24	medium
137568	Amazon Linux 2 : polkit (ALAS-2020-1437)	Nessus	Amazon Linux Local Security Checks	2020/6/18	2024/12/11	medium
130685	EulerOS 2.0 SP5 : polkit (EulerOS-SA-2019-2223)	Nessus	Huawei Local Security Checks	2019/11/8	2024/4/15	high
135625	EulerOS Virtualization 3.0.2.2 : polkit (EulerOS-SA-2020-1463)	Nessus	Huawei Local Security Checks	2020/4/16	2024/3/15	high
160791	NewStart CGSL CORE 5.04 / MAIN 5.04 : polkit Multiple Vulnerabilities (NS-SA-2022-0022)	Nessus	NewStart CGSL Local Security Checks	2022/5/9	2023/1/13	high
174078	NewStart CGSL CORE 5.05 / MAIN 5.05 : polkit Multiple Vulnerabilities (NS-SA-2023-0027)	Nessus	NewStart CGSL Local Security Checks	2023/4/11	2023/4/12	high

检测

插件搜索

medium

medium

medium

medium

medium

critical

medium

high

medium

medium

medium

medium

medium

high

high

high

high