Published: 22/07/2012 Updated: 07/11/2023

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P

The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) prior to 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux-pam linux-pam 0.99.1.0
linux-pam linux-pam 0.99.2.0
linux-pam linux-pam 0.99.2.1
linux-pam linux-pam 0.99.3.0
linux-pam linux-pam 0.99.4.0
linux-pam linux-pam 0.99.5.0
linux-pam linux-pam 0.99.6.0
linux-pam linux-pam 0.99.6.1
linux-pam linux-pam 0.99.6.2
linux-pam linux-pam 0.99.6.3
linux-pam linux-pam 0.99.7.0
linux-pam linux-pam 0.99.7.1
linux-pam linux-pam 0.99.8.0
linux-pam linux-pam 0.99.8.1
linux-pam linux-pam 0.99.9.0
linux-pam linux-pam 0.99.10.0
linux-pam linux-pam 1.0.0
linux-pam linux-pam 1.0.1
linux-pam linux-pam 1.0.2
linux-pam linux-pam 1.0.3
linux-pam linux-pam 1.0.4
linux-pam linux-pam 1.1.0
linux-pam linux-pam 1.1.1
linux-pam linux-pam 1.1.2
linux-pam linux-pam 1.1.3
linux-pam linux-pam

Synopsis Moderate: pam security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic Updated pam packages that fix two security issues, several bugs, and addvarious enhancements are now available for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this upd ...

PAM could be made to crash or run programs as an administrator ...

Kees Cook of the ChromeOS security team discovered a buffer overflow in pam_env, a PAM module to set environment variables through the PAM stack, which allowed the execution of arbitrary code An additional issue in argument parsing allows denial of service The oldstable distribution (lenny) is not affected For the stable distribution (squeeze), ...

A stack-based buffer overflow flaw was found in the way the pam_env module parsed users' "~/pam_environment" files If an application's PAM configuration contained "user_readenv=1" (this is not the default), a local attacker could use this flaw to crash the application or, possibly, escalate their privileges (CVE-2011-3148) A denial of service fl ...

CWE-119 http://secunia.com/advisories/46583 http://secunia.com/advisories/49711 https://bugs.launchpad.net/ubuntu/+source/pam/+bug/874565 http://security.gentoo.org/glsa/glsa-201206-31.xml http://www.ubuntu.com/usn/USN-1237-1 http://git.fedorahosted.org/git/?p=linux-pam.git%3Ba=commitdiff%3Bh=109823cb621c900c07c4b6cdc99070d354d19444 https://access.redhat.com/errata/RHSA-2013:0521 https://usn.ubuntu.com/1237-1/https://nvd.nist.gov

CVE-2011-3149

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect