CVE-2014-8169

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-8169
automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.

4.4 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 3.4 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://lists.opensuse.org/opensuse-updates/2015-03/msg00033.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1344.html Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/73211
http://www.ubuntu.com/usn/USN-2579-1
https://bugzilla.redhat.com/show_bug.cgi?id=1192565 Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=917977 Issue Tracking
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:a:automount_project:automount:5.0.8:*:*:*:*:*:*:*
OR cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
History

13 Feb 2023, 00:44

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:2417', 'name': 'https://access.redhat.com/errata/RHSA-2015:2417', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-8169', 'name': 'https://access.redhat.com/security/cve/CVE-2014-8169', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:1344', 'name': 'https://access.redhat.com/errata/RHSA-2015:1344', 'tags': [], 'refsource': 'MISC'}
Summary It was found that program-based automounter maps that used interpreted languages such as Python would use standard environment variables to locate and load modules of those languages. A local attacker could potentially use this flaw to escalate their privileges on the system. automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.

02 Feb 2023, 20:19

Type Values Removed Values Added
Summary automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory. It was found that program-based automounter maps that used interpreted languages such as Python would use standard environment variables to locate and load modules of those languages. A local attacker could potentially use this flaw to escalate their privileges on the system.
References
  • (MISC) https://access.redhat.com/errata/RHSA-2015:2417 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-8169 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:1344 -
Information

Published : 2015-03-18 16:59

Updated : 2023-12-10 11:31

NVD link : CVE-2014-8169

Mitre link : CVE-2014-8169

CVE.ORG link : CVE-2014-8169

JSON object : View

Products Affected

redhat

  • enterprise_linux_hpc_node
  • enterprise_linux_workstation
  • enterprise_linux_server
  • enterprise_linux_desktop

automount_project

  • automount

opensuse

  • opensuse
CWE
CWE-264

Permissions, Privileges, and Access Controls