CVE-2011-3628 — Libpam-modules vulnerability

5 documents5 sources

Severity

6.9MEDIUMNVD

EPSS

0.1%

top 84.34%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

PAM Debian PAM Canonical Libpam-modules +1 more

Timeline

PublishedApr 15

Latest updateMay 17

Description

Untrusted search path vulnerability in pam_motd (aka the MOTD module) in libpam-modules before 1.1.3-2ubuntu2.1 on Ubuntu 11.10, before 1.1.2-2ubuntu8.4 on Ubuntu 11.04, before 1.1.1-4ubuntu2.4 on Ubuntu 10.10, before 1.1.1-2ubuntu5.4 on Ubuntu 10.04 LTS, and before 0.99.7.1-5ubuntu6.5 on Ubuntu 8.04 LTS, when using certain configurations such as "session optional pam_motd.so", allows local users to gain privileges by modifying the PATH environment variable to reference a malicious command, as d…

CVSS vector

AV:L/AC:M/C:C/I:C/A:CExploitability: 3.4 | Impact: 10.0

Affected Packages3 packages

▶NVDcanonical/libpam-modules4 versions+3

▶debiandebian/pam< pam 1.1.3-7 (bookworm)

▶Debianpam/pam< 1.1.3-7+3

Also affects: Ubuntu Linux 10.04, 10.10, 11.04, 11.10, 8.04

🔴Vulnerability Details

GHSA

GHSA-9hgw-rg97-xh38: Untrusted search path vulnerability in pam_motd (aka the MOTD module) in libpam-modules before 1↗2022-05-17

▶

OSV

CVE-2011-3628: Untrusted search path vulnerability in pam_motd (aka the MOTD module) in libpam-modules before 1↗2014-04-15

▶

📋Vendor Advisories

Ubuntu

PAM vulnerabilities↗2011-10-24

▶

Debian

CVE-2011-3628: pam - Untrusted search path vulnerability in pam_motd (aka the MOTD module) in libpam-...↗2011

▶