Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-12210

In Yubico pam-u2f 1.0.7, when configured with debug and a custom debug log file is set using debug_file, that file descriptor is not closed when a new process is spawned. This leads to the file descriptor being inherited into the child process; the child process can then read from and write to it. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation.

Published

2019-06-04T21:29:00.827

Last Modified

2024-11-21T04:22:25.653

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 8.1 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.0

Impact Score

4.9

Weaknesses

Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	yubico	pam-u2f	1.0.7	Yes

References

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html ([email protected])
http://www.openwall.com/lists/oss-security/2019/06/05/1 Exploit, Mailing List, Third Party Advisory ([email protected])
https://developers.yubico.com/pam-u2f/Release_Notes.html Release Notes, Vendor Advisory ([email protected])
https://github.com/Yubico/pam-u2f/commit/18b1914e32b74ff52000f10e97067e841e5fff62 Patch, Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2019/06/05/1 Exploit, Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://developers.yubico.com/pam-u2f/Release_Notes.html Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/Yubico/pam-u2f/commit/18b1914e32b74ff52000f10e97067e841e5fff62 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)