PT-2008-3472 · Linux Pam+2 · Pam Succeed If.So+2

Published 2008-07-24 · Updated 2017-09-29 · CVE-2008-1946

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU coreutils version 5.2.1

Description The default configuration of su in /etc/pam.d/su allows local users to gain the privileges of a locked or expired account by entering the account name on the command line. This issue is related to the improper use of the pam succeed if.so module.

Recommendations For GNU coreutils version 5.2.1, consider modifying the /etc/pam.d/su configuration to properly handle locked or expired accounts, ensuring that the pam succeed if.so module is used correctly to prevent unauthorized privilege escalation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-1946

RHSA-2008:0780

RHSA-2008_0780

Affected Products

Gnu Coreutils

Red Hat

Pam Succeed If.So

References · 12

• http://secunia.com/advisories/31225 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1946 · Security Note
• https://osv.dev/vulnerability/CVE-2008-1946 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2008-0780.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1946 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-1946 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2008:0780 · Note
• http://securitytracker.com/id?1020552 · Note
• http://securityfocus.com/bid/30363 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10029 · Note
• https://access.redhat.com/security/cve/CVE-2008-1946 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43993 · Note