Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
pam_wheel in Linux-PAM 0.78, with the trust option enabled and the use_uid option disabled, allows local users to spoof log entries and gain privileges by causing getlogin() to return a spoofed user name.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Linux-PAM getlogin()可被欺骗漏洞
Vulnerability Description
Pluggable Authentication Module (PAM)是用于验证用户的机制。使用在多种Linux版本上。 Linux-PAM中的pam_wheel没有安全地使用getlogin()函数，本地攻击者可以利用这个漏洞有可能绕过部分限制，无需密码获得root用户权限。 pam_wheel模块一般结合su(1)允许属于可信组的用户无需密码使用部分命令。此模块利用getlogin()函数判断当前登录用户名，获取的用户名然后与配置文件中指定的可信组列表成员进行比较，下面是部分代码： fromsu
CVSS Information
N/A
Vulnerability Type
N/A