CVE-2012-6140

pamgoogleauthenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions and discover a shared secret via standard filesystem operations, a different vulnerability than...

Design/Logic Flaw

pamgoogleauthenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions and discover a shared secret via standard filesystem operations, a different vulnerability than...

CVE-2012-6140

pamgoogleauthenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions and discover a shared secret via standard filesystem operations, a different vulnerability than...

CVE-2012-6140

CVE-2012-6140 involves the pam_google_authenticator.c PAM module in Google Authenticator, vulnerable before 1.0. The root cause is that the secret file must have user-readable permissions, allowing local users to bypass access constraints and read the shared secret via standard filesystem operati...

CVE-2012-6140

pamgoogleauthenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions and discover a shared secret via standard filesystem operations, a different vulnerability than...

CVE-2012-6140

pamgoogleauthenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions and discover a shared secret via standard filesystem operations, a different vulnerability than...

Google Authenticator CVE-2012-6140本地信息泄露漏洞

CVE ID:CVE-2012-6140 Google Authenticator项目是可用于多手机平台的生成一次性密码的软件实现,包含可用于可插拔验证模块PAM的实现。 Google Authenticator在某些配置下执行私钥/状态文件管理时存在一个安全漏洞，由于缺少'user='选项，私钥SECRET文件需要为用户可读，允许本地攻击者获得预共享client-to-authentication-server私钥，可能导致假冒其他用户账户。 0 Google Authenticator 厂商解决方案 用户可参考如下厂商提供的安全公告获得补丁信息：...

[USN-1766-1] pam-xdg-support vulnerability

========================================================================== Ubuntu Security Notice USN-1766-1 March 18, 2013 pam-xdg-support vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivative...

PyPAM 0.4.2 Double-Free Corruption

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 === LSE Leading Security Experts - Security Advisory 2012-03-01 === PyPAM -- Python bindings for PAM - Double Free Corruption - - --------------------------------------------------------- Affected Versio...

FreeBSD Security Advisory FreeBSD-SA-11:09.pam_ssh

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-11:09.pamssh Security Advisory The FreeBSD Project Topic: pamssh improperly grants access when user account has unencrypted SSH private keys Category: contrib...

Ubuntu Update for pam USN-1237-1

Ubuntu Update for Linux kernel vulnerabilities USN-1237-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN12371.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for pam USN-1237-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This...

CVE-2011-3149

The expandarg function in the pamenv module modules/pamenv/pamenv.c in Linux-PAM aka pam before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service CPU consumption...

Fedora 16 : ecryptfs-utils-90-1.fc16 (2011-10671)

privilege escalation via mountpoint race conditions CVE-2011-1831, CVE-2011-1832 - race condition when checking source during mount CVE-2011-1833 - mtab corruption via improper handling CVE-2011-1834 - key poisoning via insecure temp directory handling CVE-2011-1835 - information disclosure via...

[SECURITY] Fedora 14 Update: pam_ssh-1.97-7.fc14

This PAM module provides single sign-on behavior for UNIX using SSH keys. Users are authenticated by decrypting their SSH private keys with the password provided. In the first PAM login session phase, an ssh-agent process is started and keys are added. The same agent is used for the following PAM...

[SECURITY] Fedora 13 Update: pam_ssh-1.97-7.fc13

This PAM module provides single sign-on behavior for UNIX using SSH keys. Users are authenticated by decrypting their SSH private keys with the password provided. In the first PAM login session phase, an ssh-agent process is started and keys are added. The same agent is used for the following PAM...

[SECURITY] Fedora 15 Update: pam_ssh-1.97-7.fc15

This PAM module provides single sign-on behavior for UNIX using SSH keys. Users are authenticated by decrypting their SSH private keys with the password provided. In the first PAM login session phase, an ssh-agent process is started and keys are added. The same agent is used for the following PAM...

CVE-2011-0438

nslcd/pam.c in the nss-pam-ldapd 0.8.0 PAM module returns a success code when a user is not found in LDAP, which allows remote attackers to bypass authentication...

Authentication flaw

nslcd/pam.c in the nss-pam-ldapd 0.8.0 PAM module returns a success code when a user is not found in LDAP, which allows remote attackers to bypass authentication...

CVE-2011-0438

nslcd/pam.c in the nss-pam-ldapd 0.8.0 PAM module returns a success code when a user is not found in LDAP, which allows remote attackers to bypass authentication...

CVE-2011-0438

CVE-2011-0438 affects the nss-pam-ldapd project: nslcd/pam.c in the 0.8.0 PAM module returns a success code when a user is not found in LDAP, enabling remote attackers to bypass authentication. The vulnerability is a direct authentication bypass caused by incorrect handling of non-existent users,...