Description
Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pam | 1.1.8-3.1 | — |
| Debian 13 | pam | 1.1.8-3.1 | — |
| Debian 12 | pam | 1.1.8-3.1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | pam | 1.1.8-1ubuntu2.1 | USN-2935-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pam | 1.3.0-3.4 | openSUSE-SU-2024:10405-1 |
Advisories 2
- USN-2935-1 pam vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:10405-1 pam-1.3.0-3.4 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- [oss-security] 20140324 pam_timestamp internals mailing-list
- 66493 vdb-entry
- GLSA-201605-05 vendor-advisory
- 57317 third-party-advisory
- USN-2935-2 vendor-advisory
- [oss-security] 20140331 Re: pam_timestamp internals mailing-list
- USN-2935-3 vendor-advisory
- USN-2935-1 vendor-advisory
- https://git.fedorahosted.org/cgit/linux-pam.git/commit/?id=Linux-PAM-1_1_8-32-g9dcead8
- [oss-security] 20140326 Re: pam_timestamp internals mailing-list