Back to Database
Status published
High
CVE-2001-1147
The PAM implementation in /bin/login of the util-linux package before...
Vulnerability Description
The PAM implementation in /bin/login of the util-linux package before 2.11 causes a password entry to be rewritten across multiple PAM calls, which could provide the credentials of one user to a different user, when used in certain PAM modules such as pam_limits.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2001-1147
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.iss.net/security_center/static/7266.php
- http://www.ciac.org/ciac/bulletins/m-009.shtml
- http://www.redhat.com/support/errata/RHSA-2001-132.html
- http://www.novell.com/linux/security/advisories/2001_034_shadow_txt.html
- http://www.securityfocus.com/bid/3415
- http://www.securityfocus.com/archive/1/219175
- http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-084.php3
More from andries brouwer
View All →CVE-2006-7108
login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is...
Medium
4.1
CVE-2005-2876
umount in util-linux 2.8 to 2.12q, 2.13-pre1, and 2.13-pre2, and...
High
7.2
CVE-2004-0080
The login program in util-linux 2.11 and earlier uses a...
Medium
5
CVE-2003-0645
man-db 2.3.12 and 2.3.18 to 2.4.1 uses certain user-controlled DEFINE...
Medium
4.6
CVE-2003-0620
Multiple buffer overflows in man-db 2.4.1 and earlier, when installed...
Medium
4.6
Affected Vendor
andries brouwer
View all reports →Affected Software
util-linux
Vulnerable Versions:
2.10s, 2.11f, 2.11h, 2.11i, 2.11k
Timeline
Official Publish:
June 25th, 2002
Last Modified:
August 8th, 2024
Added to House:
July 18th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.