Проблемы с PAM в Qpopper (information leakage)

При использовании pam выдаются разные сообщения об ошибке при неверном пароле и несуществующем пользователе...

qpopper and pam.d

Hello, Take a look at the two sessions I have with Qpopper on a Redhat Linux 7.x box from an RPM package of version 4.0.1. Existing account: root@bart /etc telnet 10.10.10.1 110 Trying 10.10.10.1... Connected to 10.10.10.1. Escape character is '^'. +OK ready [email protected] user...

CVE-2001-1459

OpenSSH 2.9 and earlier does not initiate a Pluggable Authentication Module PAM session if commands are executed with no pty, which allows local users to bypass resource limits rlimits set in pam.d...

[SECURITY] [DSA 025-2] New sparc packages of OpenSSH released

---------------------------------------------------------------------------- Debian Security Advisory DSA-025-2 [email protected] http://www.debian.org/security/ Martin Schulze January 28, 2001 - ---------------------------------------------------------------------------- Package : openssh...

[SECURITY] [DSA 025-1] New sparc packages of OpenSSH released

---------------------------------------------------------------------------- Debian Security Advisory DSA-025-1 [email protected] http://www.debian.org/security/ Martin Schulze January 28, 2001 - ---------------------------------------------------------------------------- Package : openssh...

CVE-2000-1189

Buffer overflow in pamlocaluser PAM module in Red Hat Linux 7.x and 6.x allows attackers to gain privileges...

CVE-2000-0843

Buffer overflow in pamsmb and pamntdom pluggable authentication modules PAM allow remote attackers to execute arbitrary commands via a login with a long user name...

CVE-2000-0843

Buffer overflow in pamsmb and pamntdom pluggable authentication modules PAM allow remote attackers to execute arbitrary commands via a login with a long user name...

CVE-2000-0843: Undefined Security Weakness

Buffer overflow in pamsmb and pamntdom pluggable authentication modules PAM allow remote attackers to execute arbitrary commands via a login with a long user name...

CVE-2000-0378

The vulnerability CVE-2000-0378 affects the pam_console PAM module in Linux systems. It arises because the module performs a chown on various devices at user login, and an open file descriptor for those devices can remain open after logout. This allows the user to sniff activity on those devices ...

CVE-2000-0668

CVE-2000-0668 affects the Linux pam_console PAM module when a display manager (gdm or kdm) has XDMCP enabled. The vulnerability allows a user to access the system console and reboot the system, with a Medium severity (CVSS v2 base score 5.0) and a Partial availability impact. The provided sources...

pam_smb / pam_ntdom User Name Remote Overflow

The remote telnet server shuts the connection abruptly when given a long username followed by a password. Although Nessus could not be 100% positive, it may mean that the remote host is using an older pamsmb or pamntdom pluggable authentication module to validate user credentials against a NT...

CVE-2000-0356

Summary: CVE-2000-0356 affects PAM in Red Hat Linux 6.1, where access to disabled NIS accounts is not properly locked. The entry provides no vendor patch/version details or explicit remediation. The CVSSv2 metrics indicate a local, low-complexity flaw with partial confidentiality, integrity, and ...

CVE-2000-0356

Pluggable Authentication Modules PAM in Red Hat Linux 6.1 does not properly lock access to disabled NIS accounts...

CVE-2000-0356: Undefined Security Weakness

Pluggable Authentication Modules PAM in Red Hat Linux 6.1 does not properly lock access to disabled NIS accounts...

proftp advisory

http://lamagra.seKure.de: advisory 1 Advisory: misc. bugs Programname: proftpd Versions: 1.2.0 = pre10 Vendor: proftpd.net Severity: high root shell and low Contact: [email protected] Bug1: void setproctitlechar fmt,... in src/main.c snippet memsetstatbuf, 0, sizeofstatbuf; vsnprintfstatbuf,...

sses-sshauth.txt

Sword & Shield Enterprise Security, Inc. - Security Advisory www.sses.net, Copyright c 2000 Advisory: Secure Shell Authentication Vulnerability Release Date: May 10, 2000 Application: sshd Severity: High - A user local or remote can log into any account with a valid login shell. Status: Affected...

CVE-2000-0378

The pamconsole PAM module in Linux systems performs a chown on various devices upon a user login, but an open file descriptor for those devices can be maintained after the user logs out, which allows that user to sniff activity on these devices when subsequent users log in...

CVE-2000-0052

Red Hat userhelper program in the usermode package allows local users to gain root access via PAM and a .. dot dot attack...

CVE-2000-0052

Technical details for CVE-2000-0052 are not publicly provided in the supplied documents; only the generic description is present. Monitor for updates in connected sources for affected products, versions, impact, and remediation.