tmux 1.3 and 1.4 does not properly drop group privileges, which allows local users to gain utmp group privileges via a filename to the -S command-line option.

tmux didn't drop group privileges correctly in all cases.

This is fixed by using an updated patch originating from the debian tmux package.

Fixes RHBZ 694563, 656704, 697134, CVE-2011-1496

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

tmux didn't drop group privileges correctly in all cases.

This is fixed by using an updated patch originating from the debian tmux package.

Fixes RHBZ #694563, CVE-2011-1496

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Daniel Danner discovered that tmux, a terminal multiplexer, is not properly dropping group privileges. Due to a patch introduced by Debian, when invoked with the -S option, tmux is not dropping permissions obtained through its setgid installation.

The oldstable distribution (lenny) is not affected by this problem, as it does not include tmux.

ID	Name	Product	Family	Severity
53499	Fedora 15 : tmux-1.4-4.fc15 (2011-5486)	Nessus	Fedora Local Security Checks	medium
53480	Fedora 13 : tmux-1.4-3.fc13 (2011-5156)	Nessus	Fedora Local Security Checks	medium
53463	Fedora 14 : tmux-1.4-3.fc14 (2011-5167)	Nessus	Fedora Local Security Checks	medium
53324	Debian DSA-2212-1 : tmux - privilege escalation	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2011-1496

high

Tenable Plugins

medium

medium

medium

medium