CVE-2011-3148

2011-10-2400:00:00

ubuntu.com

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

EPSS

Percentile

5.1%

JSON

Stack-based buffer overflow in the _assemble_line function in
modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local
users to cause a denial of service (crash) and possibly execute arbitrary
code via a long string of white spaces at the beginning of the
~/.pam_environment file.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/pam/+bug/874469>

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchpam< 0.99.7.1-5ubuntu6.5UNKNOWN
ubuntu10.04noarchpam< 1.1.1-2ubuntu5.4UNKNOWN
ubuntu10.10noarchpam< 1.1.1-4ubuntu2.4UNKNOWN
ubuntu11.04noarchpam< 1.1.2-2ubuntu8.4UNKNOWN
ubuntu11.10noarchpam< 1.1.3-2ubuntu2.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	pam	< 0.99.7.1-5ubuntu6.5	UNKNOWN
ubuntu	10.04	noarch	pam	< 1.1.1-2ubuntu5.4	UNKNOWN
ubuntu	10.10	noarch	pam	< 1.1.1-4ubuntu2.4	UNKNOWN
ubuntu	11.04	noarch	pam	< 1.1.2-2ubuntu8.4	UNKNOWN
ubuntu	11.10	noarch	pam	< 1.1.3-2ubuntu2.1	UNKNOWN