PT-2011-4851 · Openpam · Openam

Jeff Mitchell + 1 · Published 2011-11-17 · Updated 2017-08-29 · CVE-2011-4122

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenPAM versions prior to r478

Description A directory traversal issue exists, allowing local users to load arbitrary DSOs and gain privileges via a .. (dot dot) in the service name argument to the pam start() function. This can be demonstrated by using a .. in the -c option to kcheckpass.

Recommendations For OpenPAM versions prior to r478, update to version r478 or later to resolve the issue. As a temporary workaround, consider restricting access to the pam start() function to minimize the risk of exploitation. Avoid using the service name argument with untrusted input in the pam start() function until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2011-4122

Affected Products

Openam

References · 11

• 🔥 https://exploit-db.com/exploits/36296 · Exploit
• 🔥 http://c-skills.blogspot.com/2011/11/openpam-trickery.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4122 · Security Note
• http://secunia.com/advisories/46804 · Vendor Advisory
• http://secunia.com/advisories/46756 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/12/07/3 · Note
• http://stealth.openwall.net/xSports/pamslam · Note
• http://openwall.com/lists/oss-security/2011/12/08/9 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71205 · Note
• http://osvdb.org/76945 · Note
• http://trac.des.no/openpam/changeset/478/trunk/lib/openpam_configure.c · Note