Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 465
Alerts This Week
Warning Icon 1 465

Ubuntu 1955-1 Bypass Authorization Advisory: APT-Xapian-Index Exploit

ubuntu
Calendar Grey September 18, 2013
Scroller Ubuntu
A vulnerability in apt-xapian-index may allow for eschewing polkit authorizations. Fortify your Ubuntu environment in light of this notice.
apt-xapian-index could be tricked into bypassing polkit authorizations.

Summary

apt-xapian-index could be tricked into bypassing polkit authorizations.

Software Description:

- apt-xapian-index: maintenance and search tools for a Xapian index of Debian

package

Details:

It was discovered that apt-xapian-index was using polkit in an unsafe

manner. A local attacker could possibly use this issue to bypass intended

polkit authorizations.

Topics%20covered

Topics Covered

security advisory Ubuntu local attack polkit bypass authorization apt-xapian-index

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
  apt-xapian-index                0.45ubuntu2.1

Ubuntu 12.10:
  apt-xapian-index                0.44ubuntu7.1

Ubuntu 12.04 LTS:
  apt-xapian-index                0.44ubuntu5.1

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1955-1

CVE-2013-1064

Severity
important
Lowest
Low
Medium
High
Critical

September 18, 2013

Topics%20covered

Topics Covered

security advisory Ubuntu local attack polkit bypass authorization apt-xapian-index

Package Information

https://launchpad.net/ubuntu/+source/apt-xapian-index/0.45ubuntu2.1
https://launchpad.net/ubuntu/+source/apt-xapian-index/0.44ubuntu7.1
https://launchpad.net/ubuntu/+source/apt-xapian-index/0.44ubuntu5.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.