CVE-2012-6140

Severity: low (CVSS 1.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-04-24 · updated 2026-06-16
Weakness: CWE-200

Description

pam_google_authenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions and discover a shared secret via standard filesystem operations, a different vulnerability than CVE-2013-0258.

Affected products

Google Authenticator: through 0.91; 0.86, 0.87

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=666129
http://openwall.com/lists/oss-security/2013/04/18/10
https://bugzilla.redhat.com/show_bug.cgi?id=953505
https://code.google.com/p/google-authenticator/source/detail?r=c3414e9857ad64e52283f3266065ef3023fc69a8
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=666129
http://openwall.com/lists/oss-security/2013/04/18/10
https://bugzilla.redhat.com/show_bug.cgi?id=953505
https://code.google.com/p/google-authenticator/source/detail?r=c3414e9857ad64e52283f3266065ef3023fc69a8

Get alerted when CVE-2012-6140 or the next vulnerability affects your stack