Strix
26.1K

CVE-2014-2583

UnknownEPSS 4.09%

Last modified

CVE-2014-2583 is a vulnerability of currently unknown severity. Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.. EPSS estimates a 4.09% chance of exploitation in the next 30 days.

Description

Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.

Metrics

EPSS Probability
4.09%

89.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Linux-PamLinux-Pam1.1.8

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2014-2583?
Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.
How severe is CVE-2014-2583?
Severity scoring for CVE-2014-2583 is pending analysis. The EPSS model estimates a 4.09% probability of exploitation in the next 30 days.
How do I fix CVE-2014-2583?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2014-2583?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST