PT-2017-8352 · Saltstack+2 · Salt+2

Published 2016-04-07 · Updated 2026-04-07 · CVE-2016-3176

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Salt versions prior to 2015.5.10 Salt versions 2015.8.x prior to 2015.8.8

Description The issue allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient when PAM external authentication is enabled.

Recommendations For Salt versions prior to 2015.5.10, update to version 2015.5.10 or later. For Salt versions 2015.8.x prior to 2015.8.8, update to version 2015.8.8 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2016-1939

CVE-2016-3176

GHSA-V2RP-9CPJ-PFW2

PYSEC-2017-33

SUSE-SU-2016:0970-1

SUSE-SU-2016:0972-1

SUSE-SU-2016:1343-1

USN-8153-1

Affected Products

Alt Linux

Salt

Ubuntu

References · 22

• https://docs.saltstack.com/en/latest/topics/releases/2015.5.10.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3176 · Security Note
• https://osv.dev/vulnerability/USN-8153-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8153-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:1343-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3176 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v2rp-9cpj-pfw2 · Vendor Advisory
• https://docs.saltstack.com/en/latest/topics/releases/2015.8.8.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3176 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-33 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-3176 · Security Note
• https://ubuntu.com/security/CVE-2015-8034 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:0972-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3176 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:0970-1 · Vendor Advisory