CVE-2024-47191

Publication date 4 October 2024

Last updated 17 October 2024

Ubuntu priority

Medium

Why this priority?

pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running as root, it mishandles usersfile access, such as by calling fchown in the presence of a symlink.

Read the notes from the security team

Status

Package Ubuntu Release Status
oath-toolkit 25.04 plucky
Vulnerable
24.10 oracular
Fixed 2.6.11-3ubuntu1
24.04 LTS noble
Fixed 2.6.11-2.1ubuntu0.1
22.04 LTS jammy
Fixed 2.6.7-3ubuntu0.1
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected

Notes

mdeslaur

The libpam-oath binary package is in universe

juliaphoebe

Introduced by 60d9902b5c20f27e70f8e9c816bfdc0467567e1a (oath-toolkit-2.6.7)

References

Related Ubuntu Security Notices (USN)

    • USN-7059-1
    • OATH Toolkit vulnerability
    • 9 October 2024
    • USN-7059-2
    • OATH Toolkit vulnerability
    • 17 October 2024

Other references