CVE-2005-3538

hfaxd in HylaFAX 4.2.3, when PAM support is disabled, accepts arbitrary passwords, which allows remote attackers to gain privileges...

Fedora Core 3 : openswan-2.1.5-2.FC3.1 (2005-082)

This erratum fixes the remote exploitation of a stack based buffer overflow vulnerability in Xelerance Corp.'s Openswan, which could allow attackers to execute arbitrary code. The vulnerability specifically exists due to a lack of bounds checking in the pluto application when Openswan is compiled...

iDEFENSE Security Advisory 01.26.05: Openswan XAUTH/PAM Buffer Overflow Vulnerability

Openswan XAUTH/PAM Buffer Overflow Vulnerability iDEFENSE Security Advisory 01.26.05 www.idefense.com/application/poi/display?id=190&type=vulnerabilities January 26, 2005 I. BACKGROUND Openswan is an open source implementation of IPSEC for the Linux Operating System. Openswan is based on the...

Debian DSA-025-2 : openssh - Missing PAM support

A former security upload of OpenSSH lacked support for PAM which lead to people not being able to log onto their server. This wasonly a problem on the sparc architecture. We recommend you upgrade your ssh packages on sparc. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

GLSA-200404-06 : Util-linux login may leak sensitive data

The remote host is affected by the vulnerability described in GLSA-200404-06 Util-linux login may leak sensitive data In some situations the login program could leak sensitive data due to an incorrect usage of a reallocated pointer. NOTE: Only users who have PAM support disabled on their systems...

RHEL 2.1 : kdebase (RHSA-2003:270)

Updated KDE packages that resolve a local security issue with KDM PAM support and weak session cookie generation are now available. KDE is a graphical desktop environment for the X Window System. KDE between versions 2.2.0 and 3.1.3 inclusive contain a bug in the KDE Display Manager KDM when...

Util-linux login may leak sensitive data

Background Util-linux is a suite of essential system utilites, including login, agetty, fdisk. Description In some situations the login program could leak sensitive data due to an incorrect usage of a reallocated pointer. NOTE: Only users who have PAM support disabled on their systems i.e. -PAM i...

CVE-2003-0190

OpenSSH-portable OpenSSH 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack...

CVE-2003-0190

OpenSSH-portable OpenSSH 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack...

OpenSSH w/ PAM Multiple Timing Attack Weaknesses

The remote host seems to be running an SSH server that could allow an attacker to determine the existence of a given login by comparing the time the remote sshd daemon takes to refuse a bad password for a nonexistent login compared to the time it takes to refuse a bad password for a valid login. ...

CVE-2003-0190

OpenSSH-portable OpenSSH 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack...

CVE-2003-0190

OpenSSH-portable OpenSSH 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack...

CVE-2003-0190

CVE-2003-0190 affects OpenSSH-portable/OpenSSH 3.6.1p1 and earlier with PAM enabled. The vulnerability is a timing side‑channel: when a login attempts with a non-existent username, an error is returned immediately, allowing remote attackers to determine valid usernames. This is an information dis...

How to reproduce OpenSSH Overflow.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The R7 team did a little investigating into one of the OpenSSH vulnerabilities. The following are instructions on how to reproduce a segmentation violation in sshd v3.2.3p1: 0. Compile with PAM and S/KEY support. 1. Apply the following patch to the ss...

[SECURITY] [DSA-134-3] Unknown OpenSSH remote vulnerability

Package : ssh Problem type : remote exploit Debian-specific: no This advisory is an update to DSA-134-2: the changes mainly deal with packaging issues; if you have already successfully installed an openssh package from a previous DSA-134 advisory you may disregard this message. Theo de Raadt...

[SECURITY] [DSA 025-2] New sparc packages of OpenSSH released

---------------------------------------------------------------------------- Debian Security Advisory DSA-025-2 [email protected] http://www.debian.org/security/ Martin Schulze January 28, 2001 - ---------------------------------------------------------------------------- Package : openssh...

[SECURITY] [DSA 025-1] New sparc packages of OpenSSH released

---------------------------------------------------------------------------- Debian Security Advisory DSA-025-1 [email protected] http://www.debian.org/security/ Martin Schulze January 28, 2001 - ---------------------------------------------------------------------------- Package : openssh...