Vulnerability Report

CVE-2011-1485

Title: Redhat Policykit Auth Bypass

Auth Bypass

Proof Of Concept

PoC Available for CVE-2011-1485

CWE Category CWE-362
Published Date May 31, 2011
Modified Date Apr 29, 2026
Exploit Status Available
Score 6.9 CVSS v2.0
Exploit Probability (EPSS)
5.54%

Vulnerability Summary

CVE-2011-1485: Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.

Impacted Vendors

F
freedesktop 1
R
redhat 1

Reference Links

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058752.html http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059859.html http://secunia.com/advisories/48817 http://security.gentoo.org/glsa/glsa-201204-06.xml http://securityreason.com/securityalert/8424 http://www.debian.org/security/2011/dsa-2319 http://www.mandriva.com/security/advisories?name=MDVSA-2011:086 http://www.redhat.com/support/errata/RHSA-2011-0455.html http://www.ubuntu.com/usn/USN-1117-1 https://bugzilla.redhat.com/show_bug.cgi?id=692922 http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058752.html http://lists.fedoraproject.org/pipermail/package-announce/2011-May/059859.html http://secunia.com/advisories/48817 http://security.gentoo.org/glsa/glsa-201204-06.xml http://securityreason.com/securityalert/8424 http://www.debian.org/security/2011/dsa-2319 http://www.mandriva.com/security/advisories?name=MDVSA-2011:086 http://www.redhat.com/support/errata/RHSA-2011-0455.html http://www.ubuntu.com/usn/USN-1117-1 https://bugzilla.redhat.com/show_bug.cgi?id=692922
CVSS v2.0
Source Entity [email protected]
Severity MEDIUM
6.9
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:L/AC:M/Au:N/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2011-1485 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/35021
View Code
Exploit-DB https://www.exploit-db.com/exploits/17942
View Code
Exploit-DB https://www.exploit-db.com/exploits/17932
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A
Complexity N/A
Privileges N/A
Interaction NONE
CVSS Vector String AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected Stack

No specific products linked.