Lucene search

K
mageiaGentoo FoundationMGASA-2015-0213
HistoryMay 12, 2015 - 10:37 p.m.

Updated pam packages fix security vulnerabilities

2015-05-1222:37:48
Gentoo Foundation
advisories.mageia.org
7

5.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.003 Low

EPSS

Percentile

71.6%

Updated pam packages fix security vulnerabilities: The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack (CVE-2013-7041). Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create aribitrary files or possibly bypass authentication via a โ€ฆ (dot dot) in the PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty funtion, which is used by the format_timestamp_name function (CVE-2014-2583).

OSVersionArchitecturePackageVersionFilename
Mageia4noarchpam<ย 1.1.8-7.1pam-1.1.8-7.1.mga4

5.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.003 Low

EPSS

Percentile

71.6%