CVE-2011-4338

Name of the Vulnerable Software and Affected Versions Shaman version 1.0.9

Description The issue allows users to gain root privileges without entering the root password by adding the line askforpwd=false to the shaman.conf file. This configuration change enables root access the next time Shaman is run, even if the user never entered the root password.

Recommendations For Shaman version 1.0.9, to resolve the issue, users should remove the line askforpwd=false from the shaman.conf file to ensure that root privileges are only granted after entering the root password. As a temporary workaround, consider restricting access to the shaman.conf file to prevent unauthorized modifications.