CVE-2011-2490: Input Validation
opielogin.c in opielogin in OPIE 2.4.1-test1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by arranging for an account to already be running its maximum number of processes.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2490?
CVE-2011-2490 is classified as a high severity vulnerability due to the potential for local privilege escalation.
How do I fix CVE-2011-2490?
To mitigate CVE-2011-2490, update to a patched version of OPIE that addresses the issue with the setuid system call.
Who is affected by CVE-2011-2490?
CVE-2011-2490 affects local users of OPIE versions 2.4.1-test1 and earlier, and certain specific versions of OPIE 2.x.
What does CVE-2011-2490 exploit?
CVE-2011-2490 exploits the lack of return value checks on the setuid system call, allowing privilege escalation.
Is there a workaround for CVE-2011-2490?
While the best solution is to update OPIE, temporarily restricting local user access may serve as a workaround for CVE-2011-2490.