gnomesu-pam-backend in libgnomesu 1.0.0 prints an error message but proceeds with the non-error code path upon failure of the setgid or setuid function, which allows local users to gain privileges by leveraging access to two unprivileged user accounts, and running many processes under one of these accounts.

The libgnomesu pam backend did not check the return value of the setuid() functions. Local users could exploit that to gain root privileges (CVE-2011-1946).

The libgnomesu pam backend did not check the return value of the setuid() functions. Local users could exploit that to gain root privileges. (CVE-2011-1946)

The libgnomesu pam backend did not check the return value of the setuid() functions. Local users could exploit that to gain root privileges. (CVE-2011-1946)

Note: this is just a re-release of the previous update to fix a regression unrelated to the security issue.

ID	Name	Product	Family	Severity
75897	openSUSE Security Update : libgnomesu (openSUSE-SU-2011:0694-1)	Nessus	SuSE Local Security Checks	high
75580	openSUSE Security Update : libgnomesu (openSUSE-SU-2011:0694-1)	Nessus	SuSE Local Security Checks	high
57216	SuSE 10 Security Update : libgnomesu (ZYPP Patch Number 7580)	Nessus	SuSE Local Security Checks	high
55484	SuSE 11.1 Security Update : libgnomesu (SAT Patch Number 4805)	Nessus	SuSE Local Security Checks	high
55433	SuSE 10 Security Update : libgnomesu (ZYPP Patch Number 7581)	Nessus	SuSE Local Security Checks	high
55431	SuSE 11.1 Security Update : libgnomesu (SAT Patch Number 4735)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2011-1946

high

Tenable Plugins

high

high

high

high

high

high