Directory traversal vulnerability in openpam_configure.c in OpenPAM before r478 on FreeBSD 8.1 allows local users to load arbitrary DSOs an…

published 2011-11-17 14 y ago modified 2026-06-16 4 mo ago also EUVD-2011-4070

cvss: 6.9; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits: 1; Exploit-DB

Directory traversal vulnerability in openpam_configure.c in OpenPAM before r478 on FreeBSD 8.1 allows local users to load arbitrary DSOs and gain privileges via a .. (dot dot) in the service_name argument to the pam_start function, as demonstrated by a .. in the -c option to kcheckpass.

Timeline

2011-11-09 First public exploit (EDB-36296)
2011-11-17 Published

Exploit prediction

0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-36296 OpenPAM - 'pam_start()' Local Privilege Escalation local, 2011-11-09
c-skills.blogspot.com http://c-skills.blogspot.com/2011/11/openpam-trickery.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.9	AV:L/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

c-skills.blogspot.com /2011/11/openpam-trickery.html
exploit
secunia.com /advisories/46756
third-party-advisory, vendor-advisory
secunia.com /advisories/46804
third-party-advisory, vendor-advisory
stealth.openwall.net /xSports/pamslam
openwall.com /lists/oss-security/2011/12/07/3
mailing-list
trac.des.no /openpam/changeset/478/trunk/lib/openpam_configure.c
exchange.xforce.ibmcloud.com /vulnerabilities/71205
vdb-entry
osvdb.org /76945
vdb-entry
openwall.com /lists/oss-security/2011/12/08/9
mailing-list

Sources

CVE List CVE-2011-4122
NVD CVE-2011-4122

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary