CVE-2024-47191 - log back

CVE-2024-47191 edited at 04 Oct 2024 20:30:34
Severity
- Unknown
+ High
Remote
- Unknown
+ Local
Type
- Unknown
+ Privilege escalation
Description
+ Fabian Vogt reported that the PAM module in oath-toolkit, a collection of components to build one-time password authentication systems, does not safely perform file operations in users's home directories when using the usersfile feature (allowing to place the OTP state in the home directory of the to-be-authenticated user). A local user can take advantage of this flaw for root privilege escalation.
References
+ https://www.openwall.com/lists/oss-security/2024/10/04/2
+ https://security.opensuse.org/2024/10/04/oath-toolkit-vulnerability.html
+ https://www.nongnu.org/oath-toolkit/security/CVE-2024-47191/
Notes
+ Introduced with: https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/60d9902b5c20f27e70f8e9c816bfdc0467567e1a (oath-toolkit-2.6.7)
+ Fixed by: https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/3235a52f6b87cd1c5da6508f421ac261f5e33a70 (oath-toolkit-2.6.12)
+ Fixed by: https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/3271139989fde35ab0163b558fc29e80c3a280e5 (oath-toolkit-2.6.12)
+ Fixed by: https://gitlab.com/oath-toolkit/oath-toolkit/-/commit/95ef255e6a401949ce3f67609bf8aac2029db418 (oath-toolkit-2.6.12)
CVE-2024-47191 created at 04 Oct 2024 20:09:50