CVE-2012-6140

Published: Apr 24, 2013Modified: Apr 29, 2026

1.9

Vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 3.4 / Impact: 2.9

Source: NVD

Description

pam_google_authenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions and discover a shared secret via standard filesystem operations, a different vulnerability than CVE-2013-0258.

Affected (3)

Products: Google: Authenticator

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Google Authenticator	Up to 0.91
Google Authenticator	Version 0.86
Google Authenticator	Version 0.87

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (8)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=666129

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2013/04/18/10

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=953505

Source: secalert@redhat.com

Exploit

https://code.google.com/p/google-authenticator/source/detail?r=c3414e9857ad64e52283f3266065ef3023fc69a8

Source: secalert@redhat.com

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=666129

Source: af854a3a-2127-422b-91ae-364da2661108

http://openwall.com/lists/oss-security/2013/04/18/10

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=953505

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://code.google.com/p/google-authenticator/source/detail?r=c3414e9857ad64e52283f3266065ef3023fc69a8

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.