PT-2019-4758 · Python+2 · Pam-Python+2
Malte Kraus
·
Publicado
2019-09-24
·
Atualizado
2023-02-27
·
CVE-2019-16729
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
pam-python versions prior to 1.0.7-1
Description
The issue is related to insecure privilege management in the pam-python PAM module, which allows an attacker to escalate privileges using a specially crafted binary file with the setuid flag. This can lead to local root escalation in certain PAM setups. The vulnerability is due to the default environment variable handling of Python, which can be manipulated by a local user to gain access with root privileges.
Recommendations
For versions prior to 1.0.7-1, update to version 1.0.7-1 or later to resolve the issue. As a temporary workaround, consider restricting access to the pam-python module to minimize the risk of exploitation. Avoid using the default environment variable handling of Python in PAM setups until the issue is resolved.
Correção
Improper Privilege Management
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Ubuntu
Pam-Python