CVE-2014-8169

2015-03-1816:59:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2014-8169

automount

privilege escalation

interpreted languages

environment variables

6.1 Medium

AI Score

Confidence

Low

4.4 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.2%

JSON

automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user’s USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.

CPENameOperatorVersion
redhat:enterprise_linux_hpc_noderedhat enterprise linux hpc nodeeq6.0
redhat:enterprise_linux_desktopredhat enterprise linux desktopeq6.0
redhat:enterprise_linux_serverredhat enterprise linux servereq6.0
redhat:enterprise_linux_workstationredhat enterprise linux workstationeq6.0
automount_project:automountautomount project automounteq5.0.8
opensuse:opensuseopensuseeq13.1
opensuse:opensuseopensuseeq13.2

CPE	Name	Operator	Version
redhat:enterprise_linux_hpc_node	redhat enterprise linux hpc node	eq	6.0
redhat:enterprise_linux_desktop	redhat enterprise linux desktop	eq	6.0
redhat:enterprise_linux_server	redhat enterprise linux server	eq	6.0
redhat:enterprise_linux_workstation	redhat enterprise linux workstation	eq	6.0
automount_project:automount	automount project automount	eq	5.0.8
opensuse:opensuse	opensuse	eq	13.1
opensuse:opensuse	opensuse	eq	13.2