The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file.
CVSS Details
- CVSS 3.1 Base Score: 6.2
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade pam-develUpgrade pam | Dec 1, 2016 | Jan 24, 2011 |
| Debian | — | Upgrade pam | Jul 30, 2024 | Jan 24, 2011 |
| Gentoo Linux | — | Upgrade sys-libs/pam. | Oct 30, 2017 | Jan 24, 2011 |
| Oracle_linux | — | Upgrade pamUpgrade pam-devel | Oct 16, 2024 | Jan 24, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 3, 2010 |
| Ubuntu | — | Upgrade libpam-modules | Nov 8, 2024 | Jan 24, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub