PT-2017-8352 · Saltstack+2 · Salt+2

Publicado 2016-04-07 · Atualizado 2026-04-07 · CVE-2016-3176

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Salt versions prior to 2015.5.10 Salt versions 2015.8.x prior to 2015.8.8

Description The issue allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient when PAM external authentication is enabled.

Recommendations For Salt versions prior to 2015.5.10, update to version 2015.5.10 or later. For Salt versions 2015.8.x prior to 2015.8.8, update to version 2015.8.8 or later.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

ALT-PU-2016-1939

CVE-2016-3176

GHSA-V2RP-9CPJ-PFW2

PYSEC-2017-33

SUSE-SU-2016:0970-1

SUSE-SU-2016:0972-1

SUSE-SU-2016:1343-1

USN-8153-1

Produtos afetados

Alt Linux

Salt

Ubuntu

Referências · 22

• https://github.com/saltstack/salt · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2017-33.yaml · Nota
• https://suse.com/support/update/announcement/2016/suse-su-20160972-1 · Nota
• https://docs.saltstack.com/en/latest/topics/releases/2015.5.10.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-3176 · Nota de Segurança
• https://osv.dev/vulnerability/USN-8153-1 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2016/suse-su-20160970-1 · Nota
• https://ubuntu.com/security/notices/USN-8153-1 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2016/suse-su-20161343-1 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2016:1343-1 · Aviso do Fabricante
• https://bugzilla.suse.com/972436 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3176 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-3176 · Nota
• https://osv.dev/vulnerability/GHSA-v2rp-9cpj-pfw2 · Aviso do Fabricante
• https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html · Aviso do Fabricante