Описание
automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.
It was found that program-based automounter maps that used interpreted languages such as Python would use standard environment variables to locate and load modules of those languages. A local attacker could potentially use this flaw to escalate their privileges on the system.
Отчет
This issue does not affect the version of autofs package as shipped with Red Hat Enterprise Linux 5.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | autofs | Not affected | ||
| Red Hat Enterprise Linux 6 | autofs | Fixed | RHSA-2015:1344 | 20.07.2015 |
| Red Hat Enterprise Linux 7 | autofs | Fixed | RHSA-2015:2417 | 19.11.2015 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.6 Medium
CVSS2
Связанные уязвимости
automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.
automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.
automount 5.0.8, when a program map uses certain interpreted languages ...
automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.
EPSS
4.6 Medium
CVSS2