Vulnerability in Andries Brouwer Util-Linux
CVE-2001-1147
The PAM implementation in /bin/login of the util-linux package before 2.11 causes a password entry to be rewritten across multiple PAM calls, which could provide the credentials of one user to a different user, when used in certain PAM modules such as pam_limits.
EPSS: 0.004 (35.6th percentile) — read the EPSS interpretation.
Affected products
- Andries_brouwer Util-linux — versions 2.10s, 2.11f, 2.11h
- N/a — versions n/a
References
- cve@mitre.org (Patch, vdb-entry, Vendor Advisory, x_refsource_XF)
- cve@mitre.org (government-resource, x_refsource_CIAC, third-party-advisory)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)
- cve@mitre.org (vendor-advisory, x_refsource_SUSE)
- cve@mitre.org (Patch, vdb-entry, x_refsource_BID, Vendor Advisory)
- cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (vendor-advisory, x_refsource_MANDRAKE)