CVE-2011-3149

2011-10-2400:00:00

ubuntu.com

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

0.0004 Low

EPSS

Percentile

5.2%

JSON

The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c)
in Linux-PAM (aka pam) before 1.1.5 does not properly handle when
environment variable expansion can overflow, which allows local users to
cause a denial of service (CPU consumption).

Bugs

<https://bugs.launchpad.net/ubuntu/+source/pam/+bug/874565>

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchpam< 0.99.7.1-5ubuntu6.5UNKNOWN
ubuntu10.04noarchpam< 1.1.1-2ubuntu5.4UNKNOWN
ubuntu10.10noarchpam< 1.1.1-4ubuntu2.4UNKNOWN
ubuntu11.04noarchpam< 1.1.2-2ubuntu8.4UNKNOWN
ubuntu11.10noarchpam< 1.1.3-2ubuntu2.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	pam	< 0.99.7.1-5ubuntu6.5	UNKNOWN
ubuntu	10.04	noarch	pam	< 1.1.1-2ubuntu5.4	UNKNOWN
ubuntu	10.10	noarch	pam	< 1.1.1-4ubuntu2.4	UNKNOWN
ubuntu	11.04	noarch	pam	< 1.1.2-2ubuntu8.4	UNKNOWN
ubuntu	11.10	noarch	pam	< 1.1.3-2ubuntu2.1	UNKNOWN