Vulnerability Details : CVE-2014-8169
automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.
Products affected by CVE-2014-8169
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:a:automount_project:automount:5.0.8:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-8169
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 19 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-8169
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.4
|
MEDIUM | AV:L/AC:M/Au:N/C:P/I:P/A:P |
3.4
|
6.4
|
NIST |
CWE ids for CVE-2014-8169
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-8169
-
https://bugzilla.suse.com/show_bug.cgi?id=917977
Bug 917977 – VUL-0: CVE-2014-8169: autofs: potential privilege escalation via interpreter load path for program-based automount mapsIssue Tracking
-
http://lists.opensuse.org/opensuse-updates/2015-03/msg00033.html
openSUSE-SU-2015:0475-1: moderate: Security update for autofsVendor Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1192565
1192565 – (CVE-2014-8169) CVE-2014-8169 autofs: priv escalation via interpreter load path for program based automount mapsIssue Tracking
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
Oracle Linux Bulletin - October 2015
-
http://rhn.redhat.com/errata/RHSA-2015-1344.html
RHSA-2015:1344 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.ubuntu.com/usn/USN-2579-1
USN-2579-1: autofs vulnerability | Ubuntu security notices
-
http://www.securityfocus.com/bid/73211
Automount CVE-2014-8169 Local Privilege Escalation Vulnerability
Jump to