CVE-2011-1496 Privilege escalation in n/a
Local attackers can gain utmp group privileges by exploiting improper privilege dropping in tmux via the -S command-line option.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-1496?
CVE-2011-1496 is a medium-severity vulnerability in n/a, published on 18 Apr 2011. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
tmux 1.3 and 1.4 does not properly drop group privileges, which allows local users to gain utmp group privileges via a filename to the -S command-line option.
Weakness: CWE-264
Which versions are affected by CVE-2011-1496?
It affects 1 product.
Products include Nicholas Marriott Tmux.
How do I fix CVE-2011-1496?
Apply the vendor's patch.
Is CVE-2011-1496 being exploited?
There is no known exploitation of CVE-2011-1496 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as DEBIAN-CVE-2011-1496, DSA-2212-1, GHSA-ph56-qx6x-j8xv.