CVE-2020-27780

A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate...

CVE-2020-27780

A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate...

Oracle Solaris SunSSH PAM parse_user_name() Buffer Overflow

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle Solaris SunSSH PAM parseusername Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow in the Solaris PA...

CVE-2020-27780: Improper Authentication

A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. When the user doesn't exist PAM try to authenticate with root and in the case of an empty password it successfully authenticate...

Oracle Solaris SunSSH PAM parse_user_name() Buffer Overflow Exploit

This Metasploit module exploits a stack-based buffer overflow in the Solaris PAM library's username parsing code, as used by the SunSSH daemon when the keyboard-interactive authentication method is specified. Tested against SunSSH 1.1.5 on Solaris 10u11 1/13 x86 in VirtualBox, VMware Fusion, and...

[SECURITY] Fedora 32 Update: pam-1.3.1-29.fc32

PAM Pluggable Authentication Modules is a system security tool that allows system administrators to set authentication policy without having to recompile programs that handle authentication...

Security update for rpmlint (moderate)

openSUSE Security Update: Security update for rpmlint Announcement ID: openSUSE-SU-2020:2232-1 Rating: moderate References: 1169614 Affected Products: openSUSE Backports SLE-15-SP2 An update that contains security fixes can now be installed. Description: This update for rpmlint fixes the followin...

Fedora 32 : pam (2020-bd83344365)

fix CVE-2020-27780: authentication bypass when the user doesn't exist Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

PT-2020-21630

Name of the Vulnerable Software and Affected Versions rpmlint affected versions not specified Description The issue concerns rpmlint and involves whitelisting PAM modules and DBUS rules for cockpit. Recommendations At the moment, there is no information about a newer version that contains a fix f...

[ASA-202012-13] pam: authentication bypass

Arch Linux Security Advisory ASA-202012-13 ========================================== Severity: High Date : 2020-12-09 CVE-ID : CVE-2020-27780 Package : pam Type : authentication bypass Remote : No Link : https://security.archlinux.org/AVG-1297 Summary ======= The package pam before version 1.5.0...

OPENSUSE-SU-2020:2205-1 Security update for rpmlint

This update for rpmlint fixes the following issues: - Whitelist PAM modules and DBUS rules for cockpit bsc1169614 This update was imported from the SUSE:SLE-15:Update update project...

Security update for rpmlint (moderate)

openSUSE Security Update: Security update for rpmlint Announcement ID: openSUSE-SU-2020:2205-1 Rating: moderate References: 1169614 Affected Products: openSUSE Leap 15.2 An update that contains security fixes can now be installed. Description: This update for rpmlint fixes the following issues: -...

PT-2020-21629

Name of the Vulnerable Software and Affected Versions rpmlint affected versions not specified Description The issue concerns rpmlint and involves whitelisting PAM modules and DBUS rules for cockpit. Recommendations At the moment, there is no information about a newer version that contains a fix f...

Linux-PAM: Authentication bypass

Background Linux-PAM Pluggable Authentication Modules is an architecture allowing the separation of the development of privilege granting software from the development of secure and appropriate authentication schemes. Description A flaw was found in Linux-Pam in the way it handle empty passwords...

GLSA-202012-06 : Linux-PAM: Authentication bypass

The remote host is affected by the vulnerability described in GLSA-202012-06 Linux-PAM: Authentication bypass A flaw was found in Linux-Pam in the way it handle empty passwords for non-existing users. Impact : A remote attacker, who only needs to know a non-existing username, could bypass securit...

Escalation Of Privilege

xrdp 0.9.1 calls the PAM function authstartsession in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pamlimits.so bypass...

SUSE-SU-2020:3613-1 Security update for rpmlint

This update for rpmlint fixes the following issues: - Whitelist PAM modules and DBUS rules for cockpit bsc1169614...

PT-2020-22756

Name of the Vulnerable Software and Affected Versions rpmlint affected versions not specified Description The issue concerns whitelisting PAM modules and DBUS rules for cockpit. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

Linux-pam Authorization Issues Vulnerability

Linux-pam is a pluggable-supported system authentication software for Linux from the Linux-pam team. Linux-Pam suffers from an Authorization Problem vulnerability, which can be exploited by an attacker to bypass restrictions and escalate his privileges via the Linux-Pam root null password...

Fedora 33 : pam (2020-22532a1a81)

fix CVE-2020-27780: authentication bypass when the user doesn't exist Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...