[SECURITY] [DSA-370-1] New pam-pgsql packages fix format string vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 370-1 [email protected] http://www.debian.org/security/ Matt Zimmerman August 8th, 2003 http://www.debian.org/security/faq -...

DSA-370 pam-pgsql - format string

Bulletin has no description...

Low: Red Hat Security Advisory: : Updated openssh packages available

Updated OpenSSH packages are now available. These updates close an information leak caused by sshd's interaction with the PAM system. OpenSSH is a suite of network connectivity tools that can be used to establish encrypted connections between systems on a network and can provide interactive login...

Low: Red Hat Security Advisory: openssh security update

Updated OpenSSH packages are now available. These updates close an information leak caused by sshd's interaction with the PAM system. OpenSSH is a suite of network connectivity tools that can be used to establish encrypted connections between systems on a network and can provide interactive login...

CVE-2003-0388

pamwheel in Linux-PAM 0.78, with the trust option enabled and the useuid option disabled, allows local users to spoof log entries and gain privileges by causing getlogin to return a spoofed user name...

[Full-Disclosure] iDEFENSE Security Advisory 06.16.03: Linux-PAM getlogin() Spoofing Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDEFENSE Security Advisory 06.16.03: http://www.idefense.com/advisory/06.16.03.txt Linux-PAM getlogin Spoofing Vulnerability June 16, 2003 I. BACKGROUND The Pluggable Authentication Module PAM is a flexible mechanism for authenticating users. More...

Linux-PAM privelege escalation

It's possible to spoof user's group by spoofing terminal device...

CVE-2003-0388

CVE-2003-0388 concerns the pam_wheel module in Linux-PAM where, if the trust option is enabled and use_uid is disabled, local users can spoof getlogin() results and potentially gain privileges. The issue affects Linux-PAM versions up to 0.77 (notably around the pam_wheel and pam_lastlog handling ...

CVE-2003-0388

pamwheel in Linux-PAM 0.78, with the trust option enabled and the useuid option disabled, allows local users to spoof log entries and gain privileges by causing getlogin to return a spoofed user name...

CVE-2003-0388

pamwheel in Linux-PAM 0.78, with the trust option enabled and the useuid option disabled, allows local users to spoof log entries and gain privileges by causing getlogin to return a spoofed user name...

CVE-2003-0388: Undefined Security Weakness

pamwheel in Linux-PAM 0.78, with the trust option enabled and the useuid option disabled, allows local users to spoof log entries and gain privileges by causing getlogin to return a spoofed user name...

iDEFENSE Security Advisory 2003-06-16.t

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDEFENSE Security Advisory 06.16.03: http://www.idefense.com/advisory/06.16.03.txt Linux-PAM getlogin Spoofing Vulnerability June 16, 2003 I. BACKGROUND The Pluggable Authentication Module PAM is a flexible mechanism for authenticating users. More...

Linux PAM 0.77 - Pam_Wheel Module getlogin() Username Spoofing Privilege Escalation

Linux PAM 0.77 - PamWheel Module getlogin Username Spoofing Privilege Escalation source: https://www.securityfocus.com/bid/7929/info A vulnerability has been discovered in the Linux-Pam pamwheel module. The problem exists in the way the module authenticates users under certain configurations...

Linux PAM 0.77 - Pam_Wheel Module 'getlogin() Username' Spoofing Privilege Escalation

source: https://www.securityfocus.com/bid/7929/info A vulnerability has been discovered in the Linux-Pam pamwheel module. The problem exists in the way the module authenticates users under certain configurations. Specifically, if the module is configured to allow wheel group members to use the 's...

CVE-2003-0190

OpenSSH-portable OpenSSH 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack...

CVE-2003-0190

OpenSSH-portable OpenSSH 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack...

OpenSSH w/ PAM Multiple Timing Attack Weaknesses

The remote host seems to be running an SSH server that could allow an attacker to determine the existence of a given login by comparing the time the remote sshd daemon takes to refuse a bad password for a nonexistent login compared to the time it takes to refuse a bad password for a valid login. ...

OpenSSH/PAM timing attack allows remote users identification

Security Advisory @ Mediaservice.net Srl 01, 30/04/2003 Data Security Division Title: OpenSSH/PAM timing attack allows remote users identification Application: OpenSSH-portable = 3.6.1p1 Platform: Linux, maybe others Description: A remote attacker can identify valid users on vulnerable systems, a...

CVE-2003-0190

OpenSSH-portable OpenSSH 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack...

CVE-2003-0190: Observable Discrepancy

OpenSSH-portable OpenSSH 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack...