CVE-2008-1926: Code Injection
Argument injection vulnerability in login (login-utils/login.c) in util-linux-ng 2.14 and earlier makes it easier for remote attackers to hide activities by modifying portions of log events, as demonstrated by appending an "addr=" statement to the login name, aka "audit log injection."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1926?
The severity of CVE-2008-1926 is considered moderate due to its potential for audit log injection.
How do I fix CVE-2008-1926?
To fix CVE-2008-1926, upgrade to util-linux-ng version 2.15 or later, which addresses the vulnerability.
What systems are affected by CVE-2008-1926?
CVE-2008-1926 affects util-linux-ng versions 2.14 and earlier, particularly on Ubuntu Linux.
What types of attacks can CVE-2008-1926 enable?
CVE-2008-1926 can enable remote attackers to hide their activities by modifying log events through argument injection.
Is CVE-2008-1926 easy to exploit?
Yes, CVE-2008-1926 can be exploited relatively easily by using crafted login names that include special characters.