CVE-2008-3970

Published: Sep 11, 2008Modified: Apr 23, 2026

6.9

Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 3.4 / Impact: 10.0

Source: NVD

Description

pam_mount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volume, which allows local users to bypass intended access restrictions via a local mount.

Affected (27)

Products: Pam Mount: Pam Mount

1 product

Configuration A

27 vulnerable

Vulnerable Software	Affected Versions
Pam Mount Pam Mount	Version 0.10
Pam Mount Pam Mount	Version 0.11
Pam Mount Pam Mount	Version 0.12.2
Pam Mount Pam Mount	Version 0.13
Pam Mount Pam Mount	Version 0.15
Pam Mount Pam Mount	Version 0.16
Pam Mount Pam Mount	Version 0.17
Pam Mount Pam Mount	Version 0.18
Pam Mount Pam Mount	Version 0.19
Pam Mount Pam Mount	Version 0.20
Pam Mount Pam Mount	Version 0.21
Pam Mount Pam Mount	Version 0.26
Pam Mount Pam Mount	Version 0.27
Pam Mount Pam Mount	Version 0.28
Pam Mount Pam Mount	Version 0.29
Pam Mount Pam Mount	Version 0.31
Pam Mount Pam Mount	Version 0.32
Pam Mount Pam Mount	Version 0.35.1
Pam Mount Pam Mount	Version 0.35
Pam Mount Pam Mount	Version 0.37
Pam Mount Pam Mount	Version 0.38
Pam Mount Pam Mount	Version 0.39
Pam Mount Pam Mount	Version 0.40
Pam Mount Pam Mount	Version 0.41
Pam Mount Pam Mount	Version 0.43
Pam Mount Pam Mount	Version 0.44
Pam Mount Pam Mount	Version 0.45

Related CWEs

References (18)

http://dev.medozas.de/gitweb.cgi?p=pam_mount%3Ba=commitdiff%3Bh=33b91d7659ae3aa78b1e94fd3f8e545ae5ff25db

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html

Source: cve@mitre.org

http://sourceforge.net/mailarchive/forum.php?thread_name=alpine.LNX.1.10.0809042353120.17569%40fbirervta.pbzchgretzou.qr&forum_name=pam-mount-user

Source: cve@mitre.org

http://sourceforge.net/project/shownotes.php?release_id=624240

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2008:208

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/09/06/3

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/09/09/12

Source: cve@mitre.org

http://www.securityfocus.com/bid/31041

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/44960

Source: cve@mitre.org

http://dev.medozas.de/gitweb.cgi?p=pam_mount%3Ba=commitdiff%3Bh=33b91d7659ae3aa78b1e94fd3f8e545ae5ff25db

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://sourceforge.net/mailarchive/forum.php?thread_name=alpine.LNX.1.10.0809042353120.17569%40fbirervta.pbzchgretzou.qr&forum_name=pam-mount-user

Source: af854a3a-2127-422b-91ae-364da2661108

http://sourceforge.net/project/shownotes.php?release_id=624240

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2008:208

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2008/09/06/3

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2008/09/09/12

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/31041

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/44960

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.