CVE-2011-3149

2011-10-2400:00:00

ubuntu.com

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

EPSS

Percentile

5.1%

JSON

The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c)
in Linux-PAM (aka pam) before 1.1.5 does not properly handle when
environment variable expansion can overflow, which allows local users to
cause a denial of service (CPU consumption).

Bugs

<https://bugs.launchpad.net/ubuntu/+source/pam/+bug/874565>

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchpam< 0.99.7.1-5ubuntu6.5UNKNOWN
ubuntu10.04noarchpam< 1.1.1-2ubuntu5.4UNKNOWN
ubuntu10.10noarchpam< 1.1.1-4ubuntu2.4UNKNOWN
ubuntu11.04noarchpam< 1.1.2-2ubuntu8.4UNKNOWN
ubuntu11.10noarchpam< 1.1.3-2ubuntu2.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	pam	< 0.99.7.1-5ubuntu6.5	UNKNOWN
ubuntu	10.04	noarch	pam	< 1.1.1-2ubuntu5.4	UNKNOWN
ubuntu	10.10	noarch	pam	< 1.1.1-4ubuntu2.4	UNKNOWN
ubuntu	11.04	noarch	pam	< 1.1.2-2ubuntu8.4	UNKNOWN
ubuntu	11.10	noarch	pam	< 1.1.3-2ubuntu2.1	UNKNOWN