Unscored severity · published Mar 18, 2015
CVE-2014-8169
automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used…
–
CVSS
0.3%
EPSS
No
On KEV
Description
automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
Automount · Automount Project
5.0.8 · source: NVD
EL
Enterprise Linux Desktop · Redhat
6.0 · source: NVD
EL
Enterprise Linux Hpc Node · Redhat
6.0 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0 · source: NVD
OP
Opensuse · Opensuse
13.1; 13.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8169
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8169
Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2015-03/msg00033.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1344.html
www.oracle.com
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
www.securityfocus.com
http://www.securityfocus.com/bid/73211
www.ubuntu.com
http://www.ubuntu.com/usn/USN-2579-1
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1192565