PAM S/Key: Information disclosure

Background PAM S/Key is a pluggable authentication module for the OpenBSD Single-key Password system. Description Ulrich Müller reported that a Gentoo patch to PAM S/Key does not remove credentials provided by the user from memory. Impact A local attacker with privileged access could inspect a...

SuSE 11.2 / 11.3 Security Update : Samba (SAT Patch Numbers 8655 / 8656)

This update fixes the following security issues with samba : - DCERPC fraglen not checked. CVE-2013-4408. bnc844720 - winbind pam security problem. CVE-2012-6150. bnc853347 - No access check verification on stream files CVE-2013-4475. And fixes the following non-security issues :. bnc848101 -...

CVE-2013-2179

X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using certain implementations of the crypt API function that can return NULL, allows remote attackers to cause a denial of service NULL pointer dereference and crash by attempting to log into an account whose...

pam_winbind login without require_membership_of restrictions

Description Winbind allows for the further restriction of authenticated PAM logins using the requiremembershipof parameter. System administrators may specify a list of SIDs or groups for which an authenticated user must be a member of. If an authenticated user does not belong to any of the entrie...

UBUNTU-CVE-2012-6150

The winbindnamelisttosidstringlist function in nsswitch/pamwinbind.c in Samba through 4.1.2 handles invalid requiremembershipof group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by...

openssh, pam_ssh_agent_auth security update

CentOS Errata and Security Advisory CESA-2013:1591 Updated openssh packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common...

ESA-2013-047: RSA® Authentication Agent for PAM Unlimited Login Attempts Vulnerability

ESA-2013-047.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-047: RSA® Authentication Agent for PAM Unlimited Login Attempts Vulnerability EMC Identifier: ESA-2013-047 CVE Identifier: CVE-2013-3271 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected Products: R...

RSA Authentication Agent for PAM protection bypass

Login attepts are not limited...

HylaFAX+ 5.2.4 5.5.3 - Buffer Overflow

HylaFAX+ 5.2.4 5.5.3 - Buffer Overflow Details =========================================================== Application: "HylaFAX+" Version: 5.2.4 April, 2008 through 5.5.3 August 6, 2013 Type: Daemon that manages a fax server via an FTP-like protocol. Vendor / Maintainer: Lee Howard faxguy at...

HylaFAX+ 5.2.4 > 5.5.3 - Buffer Overflow

Details =========================================================== Application: "HylaFAX+" Version: 5.2.4 April, 2008 through 5.5.3 August 6, 2013 Type: Daemon that manages a fax server via an FTP-like protocol. Vendor / Maintainer: Lee Howard faxguy at howardsilvan.com Project Homepage:...

RHEL 5 : sssd (RHSA-2013:1319)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:1319 advisory. SSSD System Security Services Daemon provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides NSS...

[SECURITY] Fedora 20 Update: lightdm-1.7.15-1.fc20

LightDM is an X display manager that: Has a lightweight codebase Is standards compliant PAM, ConsoleKit, etc Has a well defined interface between the server and user interface Fully themeable easiest with the webkit interface Cross-desktop greeters can be written in any toolkit...

Amazon Linux AMI : pam (ALAS-2013-160)

A stack-based buffer overflow flaw was found in the way the pamenv module parsed users' '/.pamenvironment' files. If an application's PAM configuration contained 'userreadenv=1' this is not the default, a local attacker could use this flaw to crash the application or, possibly, escalate their...

CVE-2013-3271

EMC RSA Authentication Agent for PAM 7.0 before 7.0.2.1 enforces the maximum number of login attempts within the PAM-enabled application codebase, instead of within the Agent codebase, which makes it easier for remote attackers to discover correct login credentials via a brute-force attack...

CVE-2013-3271

CVE-2013-3271 affects EMC RSA Authentication Agent for PAM 7.0 and earlier (up to 7.0.2.0) where login-attempt limiting is implemented in the PAM-enabled application code rather than in the RSA Agent itself. This design allows brute-force attempts against login credentials. The issue is documente...

CVE-2013-3271

EMC RSA Authentication Agent for PAM 7.0 before 7.0.2.1 enforces the maximum number of login attempts within the PAM-enabled application codebase, instead of within the Agent codebase, which makes it easier for remote attackers to discover correct login credentials via a brute-force attack...

CVE-2013-3813

Unspecified vulnerability in Oracle Solaris 10 allows remote attackers to affect confidentiality and integrity via vectors related to Libraries/PAM-Unix...

Design/Logic Flaw

Unspecified vulnerability in Oracle Solaris 10 allows remote attackers to affect confidentiality and integrity via vectors related to Libraries/PAM-Unix...

CVE-2013-3813

Unspecified vulnerability in Oracle Solaris 10 allows remote attackers to affect confidentiality and integrity via vectors related to Libraries/PAM-Unix...

CVE-2013-3813

CVE-2013-3813 is a Solaris 10 vulnerability in the Libraries/PAM-Unix subsystem that can enable remote, unauthenticated network access via NFSv2. Affected is Solaris 10 (both x86 and SPARC) with the Libraries/PAM-Unix component; exploitation could allow unauthorized updates/inserts/deletes and re...