CVE-2011-2490

Published: Jul 27, 2011Modified: Apr 29, 2026

7.2

Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

opielogin.c in opielogin in OPIE 2.4.1-test1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by arranging for an account to already be running its maximum number of processes.

Affected (9)

Products: Nrl: Opie

1 product

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Nrl Opie	Up to 2.4.1
Nrl Opie	Version 2.10
Nrl Opie	Version 2.11
Nrl Opie	Version 2.21
Nrl Opie	Version 2.22
Nrl Opie	Version 2.2
Nrl Opie	Version 2.32
Nrl Opie	Version 2.3
Nrl Opie	Version 2.4

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (24)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631345

Source: secalert@redhat.com

Patch

http://secunia.com/advisories/39966

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/45136

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/45448

Source: secalert@redhat.com

http://www.debian.org/security/2011/dsa-2281

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2011/06/22/6

Source: secalert@redhat.com

ExploitPatch

http://www.openwall.com/lists/oss-security/2011/06/23/5

Source: secalert@redhat.com

ExploitPatch

http://www.securityfocus.com/bid/48390

Source: secalert@redhat.com

https://bugzilla.novell.com/show_bug.cgi?id=698772

Source: secalert@redhat.com

ExploitPatch

https://bugzillafiles.novell.org/attachment.cgi?id=435901

Source: secalert@redhat.com

Patch

https://hermes.opensuse.org/messages/10082052

Source: secalert@redhat.com

https://hermes.opensuse.org/messages/10082068

Source: secalert@redhat.com

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631345

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://secunia.com/advisories/39966

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/45136

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/45448

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2011/dsa-2281

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2011/06/22/6

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://www.openwall.com/lists/oss-security/2011/06/23/5

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://www.securityfocus.com/bid/48390

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.novell.com/show_bug.cgi?id=698772

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://bugzillafiles.novell.org/attachment.cgi?id=435901

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://hermes.opensuse.org/messages/10082052

Source: af854a3a-2127-422b-91ae-364da2661108

https://hermes.opensuse.org/messages/10082068

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.