Permissions, Privileges, and Access Controls in PackageKit - CVE-2013-1764
Published: April 16, 2014 / Updated: August 10, 2020
Vulnerability identifier: #VU41796
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-1764
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade packages via the "install updates" method.
Affected software
PackageKit
How to mitigate CVE-2013-1764
Install update from vendor's website.
External References
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00026.html
- http://www.openwall.com/lists/oss-security/2013/02/25/20
- https://bugs.freedesktop.org/show_bug.cgi?id=61231
- https://bugzilla.novell.com/show_bug.cgi?id=804983
- https://gitorious.org/packagekit/packagekit/commit/d3d14631042237bcfe6fb30a60e59bb6d94af425
- https://gitorious.org/packagekit/packagekit/source/NEWS