PT-2024-27527 · Fprintd · Fprintd

Yaron Shahrabani · Published 2024-06-08 · Updated 2024-09-06 · CVE-2024-37408

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions fprintd versions 1.94.3 and earlier

Description The issue is related to the lack of a security attention mechanism in fprintd, which may lead to unexpected actions being authorized by auth sufficient pam fprintd.so for Sudo. This could potentially allow unauthorized access. The supplier disputes this issue, suggesting that the resolution would involve modifying the PAM configuration to restrict pam fprintd.so to front-ends that implement a proper attention mechanism.

Recommendations For fprintd versions 1.94.3 and earlier, consider modifying the PAM configuration to restrict pam fprintd.so to front-ends that implement a proper attention mechanism as a temporary workaround. Restrict access to pam fprintd.so to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-37408

Affected Products

Fprintd

References · 15

• https://osv.dev/vulnerability/CVE-2024-37408 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-37408 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37408 · Security Note
• http://openwall.com/lists/oss-security/2024/06/13/3 · Note
• http://openwall.com/lists/oss-security/2024/06/14/3 · Note
• https://openwall.com/lists/oss-security/2024/06/13/2 · Note
• https://openwall.com/lists/oss-security/2024/05/30/3 · Note
• https://lists.freedesktop.org/archives/fprint/2024-May/001231.html · Note
• http://openwall.com/lists/oss-security/2024/06/14/2 · Note
• http://openwall.com/lists/oss-security/2024/06/14/1 · Note
• https://t.me/cvenotify/82383 · Telegram Post
• https://t.me/cvenotify/88439 · Telegram Post
• https://t.me/cvenotify/83188 · Telegram Post
• https://twitter.com/CVEnew/status/1799432954281701498 · Twitter Post
• https://gitlab.freedesktop.org/libfprint/fprintd/-/releases · Note