SB2019080712 - Red Hat update for polkit
Published: August 7, 2019 Updated: August 8, 2019
Security Bulletin ID
SB2019080712
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Command injection (CVE-ID: CVE-2018-19788)
The vulnerability allows a local authenticated attacker to execute arbitrary commands on the target system.
The vulnerability exists due to PolicyKit's improper validation of permission requests for any low-privileged user with UID greater than INT_MAX, a constant in computer programming that defines what maximum value an integer variable can store, which equals to 2147483647 (in hexadecimal 0x7FFFFFFF). A local authenticated attacker with a uid greater than INT_MAX can execute any systemctl command.
Remediation
Install update from vendor's website.