Published: 22/07/2012 Updated: 07/11/2023

CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9

VMScore: 409

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) prior to 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux-pam linux-pam 0.99.1.0
linux-pam linux-pam 0.99.2.0
linux-pam linux-pam 0.99.2.1
linux-pam linux-pam 0.99.3.0
linux-pam linux-pam 0.99.4.0
linux-pam linux-pam 0.99.5.0
linux-pam linux-pam 0.99.6.0
linux-pam linux-pam 0.99.6.1
linux-pam linux-pam 0.99.6.2
linux-pam linux-pam 0.99.6.3
linux-pam linux-pam 0.99.7.0
linux-pam linux-pam 0.99.7.1
linux-pam linux-pam 0.99.8.0
linux-pam linux-pam 0.99.8.1
linux-pam linux-pam 0.99.9.0
linux-pam linux-pam 0.99.10.0
linux-pam linux-pam 1.0.0
linux-pam linux-pam 1.0.1
linux-pam linux-pam 1.0.2
linux-pam linux-pam 1.0.3
linux-pam linux-pam 1.0.4
linux-pam linux-pam 1.1.0
linux-pam linux-pam 1.1.1
linux-pam linux-pam 1.1.2
linux-pam linux-pam 1.1.3
linux-pam linux-pam

Synopsis Moderate: pam security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic Updated pam packages that fix two security issues, several bugs, and addvarious enhancements are now available for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this upd ...

PAM could be made to crash or run programs as an administrator ...

Kees Cook of the ChromeOS security team discovered a buffer overflow in pam_env, a PAM module to set environment variables through the PAM stack, which allowed the execution of arbitrary code An additional issue in argument parsing allows denial of service The oldstable distribution (lenny) is not affected For the stable distribution (squeeze), ...

A stack-based buffer overflow flaw was found in the way the pam_env module parsed users' "~/pam_environment" files If an application's PAM configuration contained "user_readenv=1" (this is not the default), a local attacker could use this flaw to crash the application or, possibly, escalate their privileges (CVE-2011-3148) A denial of service fl ...

CWE-119 http://security.gentoo.org/glsa/glsa-201206-31.xml http://secunia.com/advisories/46583 https://bugs.launchpad.net/ubuntu/+source/pam/+bug/874469 http://secunia.com/advisories/49711 http://www.ubuntu.com/usn/USN-1237-1 http://git.fedorahosted.org/git/?p=linux-pam.git%3Ba=commitdiff%3Bh=caf5e7f61c8d9288daa49b4f61962e6b1239121d https://access.redhat.com/errata/RHSA-2013:0521 https://usn.ubuntu.com/1237-1/https://nvd.nist.gov

CVE-2011-3148

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect