This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] OATH Toolkit 2.6.12 fixes an LPE vulnerability
OATH Toolkit, a component for PAM login using one-time passwords [1], fixes a privilege escalation vulnerability in version 2.6.12. Debian 12 fixed the vulnerability in version 2.6.7-3.1+deb12u1 [2]. Ubuntu 24.04 LTS Noble fixed it in version 2.6.11-2.1ubuntu0.1 and 22.04 LTS Jammy in version 2.6.7-3ubuntu0.1; older LTS versions are not vulnerable [3]. Arch fixed the vulnerability in version 2.6.12-1 [4]. Red Hat tracks the vulnerability in Ceph Storage 5 - 7 and Openshift Container Storage 4, but no fix is available yet [5]. Fedora 39, 40 and 41 have received the fix [6], as has Gentoo [7]. Slackware does not include oath-toolkit.
An authenticated local attacker can take ownership of an arbitrary file via the pam_oath.so module by creating a symbolic link $HOME/.config/oath.secrets.new pointing to that file and performing a successful login [8].
The vulnerability is present in product:
- oath-toolkit;>=2.6.7,<2.6.12
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-47191 at cve.org, NVD
- CWE-708: Nesprávne priradenie vlastníka at cwe.mitre.org
The vulnerability was publicly disclosed 4. 10. 2024.
Links
- [1] https://www.nongnu.org/oath-toolkit/index.html
- [2] https://lists.debian.org/debian-security-announce/2024/msg00197.html
- [3] https://ubuntu.com/security/CVE-2024-47191
- [4] https://security.archlinux.org/CVE-2024-47191
- [5] https://access.redhat.com/security/cve/CVE-2024-47191
- [6] https://bugzilla.redhat.com/show_bug.cgi?id=2316493
- [7] https://packages.gentoo.org/packages/sys-auth/oath-toolkit
- [8] https://www.nongnu.org/oath-toolkit/CVE-2024-47191.html
CESNET, z.s.p.o. on 10. 10. 2024.