Pardus Parental Control
Monthly
Local privilege abuse in TUBITAK BILGEM Pardus-Parental-Control (versions up to and including 0.5.1, fixed in 0.7.0) lets a low-privileged local user exploit insecure file/resource permissions to tamper with the tool's DNS configuration and perform DNS spoofing. Because the CVSS scope is changed (S:C), the impact reaches beyond the application to system-wide name resolution, enabling redirection of traffic, bypass of parental filtering, and interception of connections. There is no public exploit identified at time of analysis, but the reachable local vector and low complexity make this a practical concern on shared or managed Pardus endpoints.
Unprivileged local users can disable all Pardus Parental Control restrictions on affected systems by invoking PPCActivator.py --disable via pkexec, which runs as root without authentication due to an overly permissive polkit policy. The flaw affects Pardus Parental Control versions before 0.7.0 and requires an interactive local session on a host with the vulnerable default policy; there is no remote vector. No public exploit code has been identified, and the issue is not known to be actively exploited.
Local privilege abuse in TUBITAK BILGEM Pardus-Parental-Control (versions up to and including 0.5.1, fixed in 0.7.0) lets a low-privileged local user exploit insecure file/resource permissions to tamper with the tool's DNS configuration and perform DNS spoofing. Because the CVSS scope is changed (S:C), the impact reaches beyond the application to system-wide name resolution, enabling redirection of traffic, bypass of parental filtering, and interception of connections. There is no public exploit identified at time of analysis, but the reachable local vector and low complexity make this a practical concern on shared or managed Pardus endpoints.
Unprivileged local users can disable all Pardus Parental Control restrictions on affected systems by invoking PPCActivator.py --disable via pkexec, which runs as root without authentication due to an overly permissive polkit policy. The flaw affects Pardus Parental Control versions before 0.7.0 and requires an interactive local session on a host with the vulnerable default policy; there is no remote vector. No public exploit code has been identified, and the issue is not known to be actively exploited.