Pam_Timestamp_Check Privilege Escalation Weakness

Bugtraq ID:	8072
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jul 02 2003 12:00AM
Updated:	Jul 02 2003 12:00AM
Credit:	Discovery of this issue is credited to Michal Zalewski <[email protected]>.
Vulnerable:	Redhat Linux 9.0 i386
Not Vulnerable:

Pam_Timestamp_Check Privilege Escalation Weakness

A weakness has been reported in the pam_timestamp_check implementation for Red Hat 9.0 and other distributions that may be derived from this version or include this functionality. Ticket contents are not sufficiently verified, allowing for tickets to be spoofed. This weakness could permit privilege escalation attacks in combination with other vulnerabilities, such as temporary file issues that permit corruption of files in privileged directories.

Pam_Timestamp_Check Privilege Escalation Weakness

There is no exploit required.

Pam_Timestamp_Check Privilege Escalation Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Pam_Timestamp_Check Privilege Escalation Weakness

References:

• Red Hat 9: free tickets (Michal Zalewski )