CVE-2011-3149 Denial of service in n/a

What is CVE-2011-3149?

CVE-2011-3149 is a low-severity denial of service vulnerability in n/a, published on 22 Jul 2012. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).

Weakness: CWE-119

Which versions are affected by CVE-2011-3149?

It affects 1 product.

Products include Linux-Pam Linux-Pam.

How do I fix CVE-2011-3149?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2011-3149 being exploited?

There is no known exploitation of CVE-2011-3149 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-28321 Auth bypass in n/a Critical 9.8
• CVE-2020-27780 Auth bypass in pam Critical 9.8
• CVE-2010-4708 Privilege escalation in n/a High 7.2
• CVE-2010-3853 Privilege escalation in n/a Medium 6.9
• CVE-2009-0887 Integer overflow in n/a Medium 6.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2011-3149, GHSA-5wc7-486v-w943.