Vulnerability Description
Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root password.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Shaman Project | Shaman | 1.0.9 |
Related Weaknesses (CWE)
References
- https://bbs.archlinux.org/viewtopic.php?id=64066&p=1ExploitThird Party Advisory
- https://www.openwall.com/lists/oss-security/2011/11/22/4Mailing ListThird Party Advisory
- https://bbs.archlinux.org/viewtopic.php?id=64066&p=1ExploitThird Party Advisory
- https://www.openwall.com/lists/oss-security/2011/11/22/4Mailing ListThird Party Advisory
FAQ
What is CVE-2011-4338?
CVE-2011-4338 is a vulnerability with a CVSS score of 7.8 (HIGH). Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact th...
How severe is CVE-2011-4338?
CVE-2011-4338 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-4338?
Check the references section above for vendor advisories and patch information. Affected products include: Shaman Project Shaman.