CVE-2008-1946: The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain the priv...

Security readout for executives and security teams

This issue affects a default su PAM configuration associated with GNU coreutils 5.2.1. A local user could switch into a locked or expired account by naming it, defeating account disablement controls. Business urgency depends on whether legacy systems still use this exact configuration and allow local user access. Exposure is most likely on older Linux systems carrying the affected GNU coreutils 5.2.1 su PAM configuration. Systems without local user access, without the vulnerable /etc/pam.d/su logic, or already updated per vendor advisories are less likely exposed. Treat this as a legacy local privilege-control issue. Prioritize environments with shared shell access, privileged dormant accounts, or old Red Hat-era builds. It is not evidenced as actively exploited in the supplied sources. Mitigation focus: Check RHSA-2008:0780 and applicable vendor advisories for supported update guidance.; Inventory systems for GNU coreutils 5.2.1 and affected su PAM configuration.; Review /etc/pam.d/su for pam_succeed_if.so logic tied to this issue..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.