Gentoo Security Advisory GLSA 200606-18 (pam_mysql)

The remote host is missing updates announced in advisory GLSA 200606-18. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Gentoo Security Advisory GLSA 200510-22 (PAM)

The remote host is missing updates announced in advisory GLSA 200510-22. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200510-22 (PAM)

The remote host is missing updates announced in advisory GLSA 200510-22. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2008-3970

pammount 0.10 through 0.45, when luserconf is enabled, does not verify mountpoint and source ownership before mounting a user-defined volume, which allows local users to bypass intended access restrictions via a local mount...

FreeBSD Security Advisory (FreeBSD-SA-06:12.opie.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-06:12.opie.asc SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

FreeBSD Security Advisory (FreeBSD-SA-03:15.openssh.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-03:15.openssh.asc ADV FreeBSD-SA-03:15.openssh.asc OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008...

HP-UX ftpd PAM Authentication Configuration Weakness Authentication Bypass

According to its banner, the version of the HP-UX FTP server running on the remote host is at a patch level before PHNE38458. Such versions reportedly contain a vulnerability that in certain account configurations could be exploited by an anonymous remote attacker to gain privileged access. Note...

CVE-2008-1668

ftpd.c in 1 wu-ftpd 2.4.2 and 2 ftpd in HP HP-UX B.11.11 assigns uid 0 to the FTP client in certain operating-system misconfigurations in which PAM authentication can succeed even though no passwd entry is available for a user, which allows remote attackers to gain privileges, as demonstrated by ...

CVE-2008-1668

CVE-2008-1668 affects HP-UX ftpd (HP-UX B.11.11) and wu-ftpd-based ftpd included with HP-UX. The issue arises when PAM authentication can succeed even if getpwnam returns NULL, allowing remote attackers to gain privileges by logging in as an LDAP user under certain misconfigurations of nsswitch.c...

CVE-2008-1668

ftpd.c in 1 wu-ftpd 2.4.2 and 2 ftpd in HP HP-UX B.11.11 assigns uid 0 to the FTP client in certain operating-system misconfigurations in which PAM authentication can succeed even though no passwd entry is available for a user, which allows remote attackers to gain privileges, as demonstrated by ...

CVE-2003-1562

MODE C CVE-2003-1562 refers to a race condition in sshd/OpenSSH 3.6.1p2 and earlier, where with PermitRootLogin disabled and using PAM keyboard-interactive authentication, sshd does not insert a delay after a root password attempt. This timing discrepancy could enable remote attackers to infer wh...

CVE-2003-1562

sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password...

CVE-2003-1562

sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password...

coreutils security update

5.2.1-31.8.0.1 - Disable test not-owner by adding coreutils-disable-not-owner.patch 5.2.1-31.8 - Fixed minor security related regression in su pam module introduced in RHEL-4.6 update,bug 445697...

GNU Coreutils pam_succeed_if PAM模块本地绕过认证漏洞

BUGTRAQ ID: 30363 CVECAN ID: CVE-2008-1946 GNU核心工具（Coreutils）是GNU操作系统所使用的基本文件、shell和文本操控工具。 Coreutils软件包没有对su命令正确地使用配置文件中的pamsucceedif可插拔认证模块（PAM），如果运行su的用户知道目标帐号的口令的话，任何本地用户都可以使用这个命令更改锁定的或过期的用户帐号。 GNU Coreutils 5.2.1 RedHat ------ RedHat已经为此发布了一个安全公告（RHSA-2008:0780-01）以及相应补丁:...

CVE-2008-1946

The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain the privileges of a 1 locked or 2 expired account by entering the account name on the command line, related to improper use of the pamsucceedif.so module...

CVE-2008-1946

The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain the privileges of a 1 locked or 2 expired account by entering the account name on the command line, related to improper use of the pamsucceedif.so module...

DEBIAN-CVE-2008-1946

The default configuration of su in /etc/pam.d/su in GNU coreutils 5.2.1 allows local users to gain the privileges of a 1 locked or 2 expired account by entering the account name on the command line, related to improper use of the pamsucceedif.so module...

GNU Coreutils 'pam_succeed_if' PAM本地验证绕过漏洞

BUGTRAQ ID: 30363 CVE ID:CVE-2008-1946 CNCVE ID：CNCVE-20081946 GNU Coreutils是一款提供一整套基本的shell工具的软件包。 GNU Coreutils存在验证绕过问题，本地攻击者可以利用漏洞运行'su'命令来获得对锁住或过期帐户的访问。 配置文件中针对"su"命令没有正确的使用pamsucceedif PAM，如果目标帐户的密码被运行"su"命令的用户知道的情况下，可使用此命令更改锁住或过期用户帐户。 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux ES ...

CentOS 3 : vsftpd (CESA-2008:0579)

An updated vsftpd package that fixes a security issue is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. vsftpd Very Secure File Transfer Protocol FTP daemon is a secure FTP server for Linux and Unix-like systems. The version of...