Vulnerability Description
kcheckpass passes a user-supplied argument to the pam_start function, often within a setuid environment, which allows local users to invoke any configured PAM stack, and possibly trigger unintended side effects, via an arbitrary valid PAM service name, a different vulnerability than CVE-2011-4122. NOTE: the vendor indicates that the possibility of resultant privilege escalation may be "a bit far-fetched."
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kde | Kcheckpass | All versions |
Related Weaknesses (CWE)
References
- http://c-skills.blogspot.com/2011/11/openpam-trickery.html
- http://openwall.com/lists/oss-security/2011/12/07/3
- http://openwall.com/lists/oss-security/2011/12/08/9
- http://openwall.com/lists/oss-security/2011/12/23/8
- http://openwall.com/lists/oss-security/2011/12/27/1
- http://openwall.com/lists/oss-security/2011/12/27/3
- http://openwall.com/lists/oss-security/2011/12/28/5
- http://openwall.com/lists/oss-security/2012/01/02/10
- http://openwall.com/lists/oss-security/2012/01/02/11
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72230
- http://c-skills.blogspot.com/2011/11/openpam-trickery.html
- http://openwall.com/lists/oss-security/2011/12/07/3
- http://openwall.com/lists/oss-security/2011/12/08/9
- http://openwall.com/lists/oss-security/2011/12/23/8
- http://openwall.com/lists/oss-security/2011/12/27/1
FAQ
What is CVE-2011-5054?
CVE-2011-5054 is a vulnerability with a CVSS score of 6.9 (MEDIUM). kcheckpass passes a user-supplied argument to the pam_start function, often within a setuid environment, which allows local users to invoke any configured PAM stack, and possibly trigger unintended si...
How severe is CVE-2011-5054?
CVE-2011-5054 has been rated MEDIUM with a CVSS base score of 6.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-5054?
Check the references section above for vendor advisories and patch information. Affected products include: Kde Kcheckpass.