CVE-2014-8169
Fixed in a distro release EPSS <1%
automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory.
Products: redhat enterprise_linux_desktop, redhat enterprise_linux_hpc_node, redhat enterprise_linux_server, redhat enterprise_linux_workstation, automount_project automount, opensuse
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | autofs | 5.0.8-2 |
| Debian 13 | autofs | 5.0.8-2 |
| Red Hat Enterprise Linux 6 | autofs | 1:5.0.5-113.el6 |
| Red Hat Enterprise Linux 6 | autofs-debuginfo | 1:5.0.5-113.el6 |
| Red Hat Enterprise Linux 7 | autofs | 1:5.0.7-54.el7 |
| Red Hat Enterprise Linux 7 | autofs-debuginfo | 1:5.0.7-54.el7 |
| SUSE Linux Enterprise Desktop 12 | autofs | 5.0.9-8.1 |
| SUSE Linux Enterprise Server 12 | autofs | 5.0.9-8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | autofs | 5.0.9-8.1 |
| openSUSE Tumbleweed | autofs | 5.1.1-3.5 |