CVE-2011-4338

Published: Feb 12, 2020Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root password.

Affected (1)

Products: Shaman Project: Shaman

Shaman Project

1 product

Shaman

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Shaman Project Shaman	Version 1.0.9

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

https://bbs.archlinux.org/viewtopic.php?id=64066&p=1

Source: secalert@redhat.com

ExploitThird Party Advisory

https://www.openwall.com/lists/oss-security/2011/11/22/4

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://bbs.archlinux.org/viewtopic.php?id=64066&p=1

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.openwall.com/lists/oss-security/2011/11/22/4

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.