CVE-2000-0378: High severity redhat Linux vulnerability
The pamconsole PAM module in Linux systems performs a chown on various devices upon a user login, but an open file descriptor for those devices can be maintained after the user logs out, which allows that user to sniff activity on these devices when subsequent users log in.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
pam_consolefrom your environment.Uninstall or remove the pam_console PAM module from systems where it is not required.
- Configuration
Disable pam_console in the system PAM configuration so the module is not invoked at user login (remove or comment out pam_console entries in your PAM stack).
PAM (pam_console) pam_console_enabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0378?
CVE-2000-0378 is classified as a medium-severity vulnerability, as it allows a user to sniff activity from devices after logging out.
How do I fix CVE-2000-0378?
To fix CVE-2000-0378, ensure that the pam_console module is properly configured to manage device ownership securely during user sessions.
Which Linux versions are affected by CVE-2000-0378?
CVE-2000-0378 affects Red Hat Linux versions 6.0, 6.1, and 6.2.
What impact does CVE-2000-0378 have on user security?
CVE-2000-0378 allows a user to potentially monitor the activities of subsequent users, which can lead to unauthorized information access.
Is CVE-2000-0378 still relevant today?
While CVE-2000-0378 was reported over two decades ago, it remains important for understanding historical vulnerabilities in legacy systems.