CVEvulnerability
CVE-2014-8169
4.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-03-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.
Affected configurations
• redhat enterprise linux desktop 6.0
• redhat enterprise linux hpc node 6.0
• redhat enterprise linux server 6.0
• redhat enterprise linux workstation 6.0
• automount project automount 5.0.8
• opensuse opensuse 13.1
• opensuse opensuse 13.2
Related
Weakness · not in database (1)
References
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00033.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1344.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html www.oracle.com
- http://www.securityfocus.com/bid/73211 www.securityfocus.com
- http://www.ubuntu.com/usn/USN-2579-1 www.ubuntu.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1192565 Issue Tracking
- https://bugzilla.suse.com/show_bug.cgi?id=917977 Issue Tracking
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00033.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1344.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html www.oracle.com
- http://www.securityfocus.com/bid/73211 www.securityfocus.com
- http://www.ubuntu.com/usn/USN-2579-1 www.ubuntu.com
- https://bugzilla.redhat.com/show_bug.cgi?id=1192565 Issue Tracking
- https://bugzilla.suse.com/show_bug.cgi?id=917977 Issue Tracking