CVE-2013-4325: Race Condition
Sebastian Krahmer reported a security issue was found in polkit (CVE-2013-4288 bz 1002375).
It was found that hplip was vulnerable to this issue as well, since it communicated to polkit authority using an unsafe DBUS interface.
This issue has been assigned CVE-2013-4325
Other sources
The checkpermissionv1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.9 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4325?
CVE-2013-4325 has been classified as having moderate severity.
How do I fix CVE-2013-4325?
To fix CVE-2013-4325, you should update to the latest version of HP Linux Imaging and Printing.
What systems are affected by CVE-2013-4325?
CVE-2013-4325 affects specific versions of HP Linux Imaging and Printing, including 1.0, 2.0, and several subsequent 3.x versions.
Is CVE-2013-4325 being actively exploited?
As of the current status, there are no known active exploits for CVE-2013-4325.
Who reported CVE-2013-4325?
CVE-2013-4325 was reported by Sebastian Krahmer.