Описание
Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations.
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | ignored | end of life |
| devel | DNE | pulled 2010-07-27 |
| gutsy | ignored | end of life, was needs-triage |
| hardy | ignored | end of life |
| intrepid | ignored | end of life, was needed |
| jaunty | not-affected | 3.10-2.1ubuntu1 |
| karmic | not-affected | 3.10-2.1ubuntu1 |
| lucid | not-affected | 3.15-2ubuntu1 |
| maverick | not-affected | 3.15-2ubuntu1 |
| natty | not-affected | 3.15-2ubuntu1 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| dapper | ignored | end of life |
| devel | released | 3.11-4ubuntu1 |
| gutsy | ignored | end of life, was needed |
| hardy | released | 3.10-1ubuntu0.8.04.1 |
| intrepid | released | 3.10-1ubuntu0.8.10.1 |
| jaunty | released | 3.11-4ubuntu1 |
| karmic | released | 3.11-4ubuntu1 |
| lucid | released | 3.11-4ubuntu1 |
| maverick | released | 3.11-4ubuntu1 |
| natty | released | 3.11-4ubuntu1 |
Показывать по
EPSS
4.6 Medium
CVSS2
Связанные уязвимости
Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations.
Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in So ...
Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam_setcred when running setuid, which allows local users to overwrite and change the ownership of arbitrary files by setting the KRB5CCNAME environment variable, and then launching a setuid application that performs certain pam_setcred operations.
Уязвимости операционной системы Debian GNU/Linux, позволяющие локальному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
EPSS
4.6 Medium
CVSS2