opielogin.c in opielogin in OPIE 2.4.1-test1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by arranging for an account to already be running its maximum number of processes.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631345 - Patch | |
| References | () http://secunia.com/advisories/39966 - Vendor Advisory | |
| References | () http://secunia.com/advisories/45136 - Vendor Advisory | |
| References | () http://secunia.com/advisories/45448 - | |
| References | () http://www.debian.org/security/2011/dsa-2281 - | |
| References | () http://www.openwall.com/lists/oss-security/2011/06/22/6 - Exploit, Patch | |
| References | () http://www.openwall.com/lists/oss-security/2011/06/23/5 - Exploit, Patch | |
| References | () http://www.securityfocus.com/bid/48390 - | |
| References | () https://bugzilla.novell.com/show_bug.cgi?id=698772 - Exploit, Patch | |
| References | () https://bugzillafiles.novell.org/attachment.cgi?id=435901 - Patch | |
| References | () https://hermes.opensuse.org/messages/10082052 - | |
| References | () https://hermes.opensuse.org/messages/10082068 - |
Information
Published : 2011-07-27 02:55
Updated : 2024-11-21 01:28
NVD link : CVE-2011-2490
Mitre link : CVE-2011-2490
CVE.ORG link : CVE-2011-2490
JSON object : View
Products Affected
nrl
- opie
CWE
CWE-20
Improper Input Validation