Webmin / Usermin PAM Authentication Bypass Vulnerability

Secunia Advisory: SA16858 Release Date: 2005-09-20 Critical: Moderately critical Impact: Security Bypass Where: From remote Solution Status: Vendor Patch Software: Usermin 1.x Webmin 1.x Select a product and view a complete list of all Patched/Unpatched Secunia advisories affecting it. Descriptio...

Security Flaw in pam_per_user Module

Summary/Impact: --------------- There is a security flaw in the pamperuser PAM module that can allow someone to authenticate as any user on the system, provided that they already have the proper credentials for one account. This security hole is fixed in pamperuser-0.4, which is available from:...

DEBIAN-CVE-2005-2641

Unknown vulnerability in pamldap before 180 does not properly handle a new password policy control, which could allow attackers to gain privileges. NOTE: CVE-2005-2497 had also been assigned to this issue, but CVE-2005-2641 is the correct candidate...

CVE-2005-2641

Unknown vulnerability in pamldap before 180 does not properly handle a new password policy control, which could allow attackers to gain privileges. NOTE: CVE-2005-2497 had also been assigned to this issue, but CVE-2005-2641 is the correct candidate...

CVE-2004-2396

passwd 0.68 does not check the return code for the pamstart function, which has unknown impact and attack vectors that may prevent "safe and proper operation" of PAM...

CVE-2004-2396

The CVE-2004-2396 issue concerns passwd 0.68 failing to check the return code from pam_start, per Mandrake MDKSA-2004:045. This indicates a potential risk in PAM initialization that could affect safe and proper operation; exact impact is not quantified in the documents. The connected advisory not...

CVE-2004-2396: Undefined Security Weakness

passwd 0.68 does not check the return code for the pamstart function, which has unknown impact and attack vectors that may prevent "safe and proper operation" of PAM...

CVE-2002-2098

Buffer overflow in axspawn.c in Axspawn-pam before 0.2.1a allows remote attackers to execute arbitrary code via large packets...

CVE-2002-2098

The CVE-2002-2098 entry describes a buffer overflow in axspawn.c within Axspawn-pam prior to 0.2.1a, allowing remote code execution via large packets. The issue affects the Axspawn-pam component and is caused by unsafe handling in axspawn.c. Impact is described as partial confidentiality, integri...

CVE-2002-2098: Undefined Security Weakness

Buffer overflow in axspawn.c in Axspawn-pam before 0.2.1a allows remote attackers to execute arbitrary code via large packets...

USN-152-1: PAM/NSS LDAP vulnerabilitiy

Andrea Barisani discovered a flaw in the SSL handling of pam-ldap and libnss-ldap. When a client connected to a consumer LDAP server using SSL, the consumer server did not use SSL as well when contacting the LDAP provider server. This caused passwords and other confident information to be...

Slackware 8.1 / 9.0 / current : New OpenSSH packages (SSA:2003-266-01)

Upgraded OpenSSH 3.7.1p2 packages are available for Slackware 8.1, 9.0 and -current. This fixes security problems with PAM authentication. It also includes several code cleanups from Solar Designer. Slackware is not vulnerable to the PAM problem, and it is not believed that any of the other code...

DEBIAN-CVE-2005-2069

pamldap and nssldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password...

Low: Red Hat Security Advisory: rsh security update

Updated rsh packages that fix various bugs and a theoretical security issue are now available. This update has been rated as having low security impact by the Red Hat Security Response Team The rsh package contains a set of programs that allow users to run commands on remote machines, login to...

RHEL 3 : rsh (RHSA-2005:074)

Updated rsh packages that fix various bugs and a theoretical security issue are now available. This update has been rated as having low security impact by the Red Hat Security Response Team The rsh package contains a set of programs that allow users to run commands on remote machines, login to...

rsh security update

CentOS Errata and Security Advisory CESA-2005:074 Updated rsh packages that fix various bugs and a theoretical security issue are now available. This update has been rated as having low security impact by the Red Hat Security Response Team The rsh package contains a set of programs that allow use...

CVE-2001-1459

OpenSSH

CVE-2001-1459

OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module PAM session if commands are executed with no pty, which allows local users to bypass resource limits rlimits set in pam.d...

CVE-2001-1459: Undefined Security Weakness

OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module PAM session if commands are executed with no pty, which allows local users to bypass resource limits rlimits set in pam.d...

Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords

Greetings, There appears to be some deficiencies in both the documentation of the 'md5' authentication methology in pghba.conf and in the md5 hash generation which is stored in pgshadow. The md5 hash which is generated for and stored in pgshadow does not use a random salt but instead uses the...