Environment Module Command Injection Vulnerability

Environment modules have a command injection vulnerability. This vulnerability arises when a local attacker places a maliciously named modulefile in a visible location within the victim’s MODULEPATH. When the victim uses Bash completion for the module or the ml command, the malicious module name,...

PAM Environment Variable Injection

PAM pamenv.so module allows environment variable injection via /.pamenvironment leading to privilege escalation through SystemD session manipulation. This scripts gauges exploitability...

MediaTek Chip Security Breach

MediaTek chips are a variety of chips from MediaTek, a Chinese company. A security vulnerability exists in the MediaTek chips, which stems from a lack of privilege checking in the aee module, which could lead to privilege escalation...

openssh: privilege escalation via user's PAM environment and UseLogin=yes

It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running the login program. In configurations with UseLogin=yes and the pamenv PAM module configured to read user environment settings, a local user could use this flaw to execute arbitrary code as root...

pam buffer overflow

pamenv module buffer overflow...

PT-2010-1042 · Linux +1 · Linux-Pam +1

Name of the Vulnerable Software and Affected Versions: Linux-PAM versions prior to 1.1.2 Red Hat Enterprise Linux pam-devel version 1.1.1 Red Hat Enterprise Linux pam-debuginfo version 1.1.1 Red Hat Enterprise Linux pam version 1.1.1 Description: The issue concerns multiple vulnerabilities in the...