CVE-2002-2098: Undefined Security Weakness

Buffer overflow in axspawn.c in Axspawn-pam before 0.2.1a allows remote attackers to execute arbitrary code via large packets...

USN-152-1: PAM/NSS LDAP vulnerabilitiy

Andrea Barisani discovered a flaw in the SSL handling of pam-ldap and libnss-ldap. When a client connected to a consumer LDAP server using SSL, the consumer server did not use SSL as well when contacting the LDAP provider server. This caused passwords and other confident information to be...

Slackware 8.1 / 9.0 / current : New OpenSSH packages (SSA:2003-266-01)

Upgraded OpenSSH 3.7.1p2 packages are available for Slackware 8.1, 9.0 and -current. This fixes security problems with PAM authentication. It also includes several code cleanups from Solar Designer. Slackware is not vulnerable to the PAM problem, and it is not believed that any of the other code...

DEBIAN-CVE-2005-2069

pamldap and nssldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password...

Low: Red Hat Security Advisory: rsh security update

Updated rsh packages that fix various bugs and a theoretical security issue are now available. This update has been rated as having low security impact by the Red Hat Security Response Team The rsh package contains a set of programs that allow users to run commands on remote machines, login to...

RHEL 3 : rsh (RHSA-2005:074)

Updated rsh packages that fix various bugs and a theoretical security issue are now available. This update has been rated as having low security impact by the Red Hat Security Response Team The rsh package contains a set of programs that allow users to run commands on remote machines, login to...

rsh security update

CentOS Errata and Security Advisory CESA-2005:074 Updated rsh packages that fix various bugs and a theoretical security issue are now available. This update has been rated as having low security impact by the Red Hat Security Response Team The rsh package contains a set of programs that allow use...

CVE-2001-1459

OpenSSH

CVE-2001-1459

OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module PAM session if commands are executed with no pty, which allows local users to bypass resource limits rlimits set in pam.d...

Postgres: pg_hba.conf, md5, pg_shadow, encrypted passwords

Greetings, There appears to be some deficiencies in both the documentation of the 'md5' authentication methology in pghba.conf and in the md5 hash generation which is stored in pgshadow. The md5 hash which is generated for and stored in pgshadow does not use a random salt but instead uses the...

CVE-2001-1459: Undefined Security Weakness

OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module PAM session if commands are executed with no pty, which allows local users to bypass resource limits rlimits set in pam.d...

DEBIAN-CVE-2004-1001

Unknown vulnerability in the passwdcheck function in Shadow 4.0.4.1, and possibly other versions before 4.0.5, allows local users to conduct unauthorized activities when an error from a pamchauthtok function call is not properly handled...

Fedora Core 3 : openswan-2.1.5-2.FC3.1 (2005-082)

This erratum fixes the remote exploitation of a stack based buffer overflow vulnerability in Xelerance Corp.'s Openswan, which could allow attackers to execute arbitrary code. The vulnerability specifically exists due to a lack of bounds checking in the pluto application when Openswan is compiled...

CVE-2005-0162

Openswan pluto vulnerability (CVE-2005-0162): stack-based buffer overflow in get_internal_addresses in Openswan 1.x prior to 1.0.9 and 2.x prior to 2.3.0 when built with XAUTH and PAM. Remote authenticated attackers could execute arbitrary code. Affects the pluto component; exploitation context m...

iDEFENSE Security Advisory 01.26.05: Openswan XAUTH/PAM Buffer Overflow Vulnerability

Openswan XAUTH/PAM Buffer Overflow Vulnerability iDEFENSE Security Advisory 01.26.05 www.idefense.com/application/poi/display?id=190&type=vulnerabilities January 26, 2005 I. BACKGROUND Openswan is an open source implementation of IPSEC for the Linux Operating System. Openswan is based on the...

CVE-2005-0162

Stack-based buffer overflow in the getinternaladdresses function in the pluto application for Openswan 1.x before 1.0.9, and Openswan 2.x before 2.3.0, when compiled with XAUTH and PAM enabled, allows remote authenticated attackers to execute arbitrary code...

DEBIAN-CVE-2004-1340

Debian GNU/Linux 3.0 installs the libpam-radius-auth package with the pamradiusauth.conf set to be world-readable, which allows local users to obtain sensitive information...

DEBIAN-CVE-2005-0108

Apache modauthradius 1.5.4 and libpam-radius-auth allow remote malicious RADIUS servers to cause a denial of service crash via a RADIUSREPLYMESSAGE with a RADIUS attribute length of 1, which leads to a memcpy operation with a -1 length argument...

CVE-2004-2396

passwd 0.68 does not check the return code for the pamstart function, which has unknown impact and attack vectors that may prevent "safe and proper operation" of PAM...

Debian DSA-177-1 : pam -- serious security violation

A serious security violation in PAM was discovered. Disabled passwords i.e. those with '' in the password file were classified as empty password and access to such accounts is granted through the regular login procedure getty, telnet, ssh. This works for all such accounts whose shell field in the...