CVE-2012-6140 pam_google_authenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions....
LowCVSS 1.9
EPSS 0.23%
- Published
- Updated
- Exploit status
- No public exploit known
Description
pam_google_authenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions and discover a shared secret via standard filesystem operations, a different vulnerability than CVE-2013-0258.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/google-authenticator(Debian:12) | < 20130529-1 | 20130529-1 |
| debian/google-authenticator(Debian:13) | < 20130529-1 | 20130529-1 |
| debian/google-authenticator(Debian:14) | < 20130529-1 | 20130529-1 |
| Google authenticator | <= 0.91 | No fix listed |
| Google authenticator | = 0.86 | No fix listed |
| Google authenticator | = 0.87 | No fix listed |
References
- Debian Security Tracker CVE-2012-6140 vendor-advisory
- bugs.debian.org
- [oss-security] 20130418 Re: CVE-2012-XXYY Request -- google-authenticator: Information disclosure due insecure requirement on the secrets file mailing-list
- bugzilla.redhat.com exploit
- code.google.com
- bugs.debian.org issue-tracking