Unscored severity · published Jul 27, 2011
CVE-2011-2490
opielogin.c in opielogin in OPIE 2.4.1-test1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by arranging for an…
–
CVSS
0.5%
EPSS
No
On KEV
Description
opielogin.c in opielogin in OPIE 2.4.1-test1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by arranging for an account to already be running its maximum number of processes.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opie · Nrl
through 2.4.1; 2.2; 2.3; 2.4; 2.10; 2.11; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-2490
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-2490
Patch
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631345
Vendor Advisory
http://secunia.com/advisories/39966
Vendor Advisory
http://secunia.com/advisories/45136
secunia.com
http://secunia.com/advisories/45448
www.debian.org
http://www.debian.org/security/2011/dsa-2281
Exploit
http://www.openwall.com/lists/oss-security/2011/06/22/6
More from Opie
–
CVE-2011-2489
Multiple off-by-one errors in opiesu.c in opiesu in OPIE 2.4.1-test1 and earlier might allow local users to gain privileges via a crafted command line
–
CVE-2010-1938
Off-by-one error in the __opiereadrec function in readrec.c in libopie in OPIE 2.4.1-test1 and earlier, as used on FreeBSD 6.4 through 8.1-PRERELEASE and other platforms, allows…