PT-2001-1040 · Util Linux+1 · Util-Linux+1

Published 2001-10-08 · Updated 2008-09-05 · CVE-2001-1147

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions util-linux versions prior to 2.11

Description The issue concerns the PAM implementation in the util-linux package, specifically in /bin/login. It allows a password entry to be rewritten across multiple PAM calls, potentially providing one user's credentials to another user when used with certain PAM modules like pam limits. Multiple vulnerabilities in the util-linux package could lead to breaches of confidentiality, integrity, and availability of protected information, with potential for local exploitation.

Recommendations For util-linux versions prior to 2.11, update to version 2.11 or later to resolve the issue. As a temporary workaround, consider restricting the use of PAM modules that could exploit this issue, such as pam limits, until the update is applied.

Fix

Related Identifiers

BDU:2015-07970

CVE-2001-1147

Affected Products

Pam Limits

Util-Linux

References · 10

• http://securityfocus.com/bid/3415 · Vendor Advisory
• http://securityfocus.com/archive/1/219175 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1147 · Security Note
• http://linux-mandrake.com/en/security/2001/MDKSA-2001-084.php3 · Vendor Advisory
• http://iss.net/security_center/static/7266.php · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07970 · Security Note
• http://novell.com/linux/security/advisories/2001_034_shadow_txt.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2001-132.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2001-132.html · Note
• http://ciac.org/ciac/bulletins/m-009.shtml · Note