PT-2001-1040 · Util Linux+1 · Util-Linux+1

Publicado 2001-10-08 · Atualizado 2008-09-05 · CVE-2001-1147

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions util-linux versions prior to 2.11

Description The issue concerns the PAM implementation in the util-linux package, specifically in /bin/login. It allows a password entry to be rewritten across multiple PAM calls, potentially providing one user's credentials to another user when used with certain PAM modules like pam limits. Multiple vulnerabilities in the util-linux package could lead to breaches of confidentiality, integrity, and availability of protected information, with potential for local exploitation.

Recommendations For util-linux versions prior to 2.11, update to version 2.11 or later to resolve the issue. As a temporary workaround, consider restricting the use of PAM modules that could exploit this issue, such as pam limits, until the update is applied.

Correção

Identificadores relacionados

BDU:2015-07970

CVE-2001-1147

Produtos afetados

Pam Limits

Util-Linux

Referências · 10

• http://securityfocus.com/bid/3415 · Aviso do Fabricante
• http://securityfocus.com/archive/1/219175 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2001-1147 · Nota de Segurança
• https://rhn.redhat.com/errata/RHSA-2001-132.html · Nota
• http://linux-mandrake.com/en/security/2001/MDKSA-2001-084.php3 · Aviso do Fabricante
• http://iss.net/security_center/static/7266.php · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-07970 · Nota de Segurança
• http://novell.com/linux/security/advisories/2001_034_shadow_txt.html · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2001-132.html · Aviso do Fabricante
• http://ciac.org/ciac/bulletins/m-009.shtml · Nota