VDB
CVE-2008-3970
CVE-2008-3970
PUBLISHED
CVSS 6.900000095367432 MEDIUM
pam_mount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volume, which allows local users to bypass intended access restrictions via a local mount.
EPSS 0.32% · 24.7th percentile
Risk Scores
CVSS 2.0
6.900000095367432
EPSS Score
0.32%
24.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| pam_mount | pam_mount | 0.11, 0.10, 0.12.2 |
| n/a | n/a | n/a |
Timeline
- Sep 10, 2008 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 22, 2022 EPSS Score
- Jul 15, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Oct 30, 2022 EPSS Score
- Dec 23, 2022 EPSS Score
- Feb 14, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 9, 2023 EPSS Score
- Jun 1, 2023 EPSS Score
References
- [pam-mount-user] 20080905 pam_mount 0.47 released mailing-list
- MDVSA-2008:208 vendor-advisory
- [oss-security] 20080909 Re: CVE request: pam_mount < 0.47 missing security checks mailing-list
- [oss-security] 20080906 CVE request: pam_mount < 0.47 missing security checks mailing-list
- pammount-luserconf-privilege-escalation(44960) vdb
- http://sourceforge.net/project/shownotes.php?release_id=624240 url
- 31041 vdb
- http://dev.medozas.de/gitweb.cgi?p=pam_mount%3Ba=commitdiff%3Bh=33b91d7659ae3aa78b1e94fd3f8e545ae5ff25db url
- SUSE-SR:2008:019 vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2008-3970 advisory
- http://dev.medozas.de/gitweb.cgi?p=pam_mount;a=commitdiff;h=33b91d7659ae3aa78b1e94fd3f8e545ae5ff25db url