PT-2011-5206 · Debian+4 · Debian+5

Kees + 1 · Published 1970-01-01 · Updated 2024-06-15 · CVE-2011-3149

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions openSUSE pam versions (affected versions not specified) SUSE Linux Enterprise pam versions (affected versions not specified) Debian GNU/Linux pam versions (affected versions not specified) pam-devel versions (affected versions not specified) pam-doc versions (affected versions not specified) pam-32bit versions (affected versions not specified) pam-64bit versions (affected versions not specified) pam-devel-32bit versions (affected versions not specified) pam-devel-64bit versions (affected versions not specified) Linux-PAM versions prior to 1.1.5

Description The issue concerns multiple vulnerabilities in the pam package of various Linux operating systems, including openSUSE, SUSE Linux Enterprise, and Debian GNU/Linux. These vulnerabilities can be exploited locally, potentially leading to a violation of confidentiality, integrity, and availability of protected information. The expand arg function in the pam env module of Linux-PAM is also vulnerable to a denial of service (CPU consumption) due to improper handling of environment variable expansion overflows.

Recommendations For Linux-PAM versions prior to 1.1.5, update to version 1.1.5 or later to resolve the issue. For other affected versions, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-03055

BDU:2015-04370

BDU:2015-04371

BDU:2015-04372

BDU:2015-04373

BDU:2015-04374

BDU:2015-04633

BDU:2015-04634

BDU:2015-05381

BDU:2015-05382

BDU:2015-05383

BDU:2015-05384

BDU:2015-05385

CESA-2013_0521

CVE-2011-3149

DSA-2326-1

OPENSUSE-SU-2024:10405-1

RHSA-2013:0521

RHSA-2013_0521

Affected Products

Centos

Debian

Linux-Pam

Red Hat

Suse Linux Enterprise

Opensuse

References · 52

• 🔥 http://git.fedorahosted.org/git/?p=linux-pam.git;a=commitdiff;h=109823cb621c900c07c4b6cdc99070d354d19444 · Exploit
• https://bdu.fstec.ru/vul/2015-04371 · Security Note
• https://bdu.fstec.ru/vul/2015-05385 · Security Note
• https://bdu.fstec.ru/vul/2015-03055 · Security Note
• https://bdu.fstec.ru/vul/2015-05384 · Security Note
• http://secunia.com/advisories/49711 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04374 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3149 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3148 · Security Note
• https://osv.dev/vulnerability/CVE-2011-3149 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05381 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-0521.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04370 · Security Note
• http://ubuntu.com/usn/USN-1237-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-3149 · Vendor Advisory