automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade autofs | Jul 30, 2024 | Mar 18, 2015 |
| Oracle_linux | — | Upgrade autofs | Oct 16, 2024 | Mar 18, 2015 |
| Suse | — | Upgrade autofs | Dec 18, 2015 | Mar 18, 2015 |
| Ubuntu | — | Upgrade autofs | Nov 8, 2024 | Mar 18, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub