CVE-2008-2516

pamsmauthenticate in pampgsql.c in libpam-pgsql 0.6.3 does not properly consider operator precedence when evaluating the success of a pamgetpass function call, which allows local users to gain privileges via a SIGINT signal when this function is executing, as demonstrated by a CTRL-C sequence at ...

CVE-2008-2516

CVE-2008-2516 affects libpam-pgsql 0.6.3: pam_sm_authenticate in pam_pgsql.c does not correctly handle operator precedence when evaluating pam_get_pass, enabling local privilege escalation via a SIGINT (CTRL-C) at a sudo password prompt under an auth sufficient pam_pgsql.so configuration. Exploit...

libpam-pgsql pam_pgsql.c文件绕过认证漏洞

BUGTRAQ ID: 29360 libpam-pgsql是使用PostgreSQL数据库认证用户的PAM模块。 libpam-pgsql的pampgsql.c文件中的pamsmauthenticate函数存在安全漏洞，如果在认证过程中发送了SIGINT，例如在sudo要求输入用户口令时按下Ctrl+C，则无需输入正确口令sudo也可以成功。 libpam-pgsql 0.6.3 libpam-pgsql ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Debian Security Advisory DSA 1203-1 (libpam-ldap)

The remote host is missing an update to libpam-ldap announced via advisory DSA 1203-1. Steve Rigler discovered that the PAM module for authentication against LDAP servers processes PasswordPolicyReponse control messages incorrectly, which might lead to an attacker being able to login into a...

Debian Security Advisory DSA 785-1 (libpam-ldap)

The remote host is missing an update to libpam-ldap announced via advisory DSA 785-1. It has been discovered that libpam-ldap, the Pluggable Authentication Module allowing LDAP interfaces, ignores the result of an attempt to authenticate against an LDAP server that does not set an optional data...

Debian: Security Advisory (DSA-1203-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-785-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-659-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 374-1 (libpam-smb)

The remote host is missing an update to libpam-smb announced via advisory DSA 374-1. OpenVAS Vulnerability Test $Id: deb3741.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 374-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 659-1 (libpam-radius-auth)

The remote host is missing an update to libpam-radius-auth announced via advisory DSA 659-1. OpenVAS Vulnerability Test $Id: deb6591.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 659-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian: Security Advisory (DSA-374)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

HP-UX Security Patch : PHCO_26089

libpam and libpamunix cumulative patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if !definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid26250; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate",...

Debian DSA-1203-1 : libpam-ldap - programming error

Steve Rigler discovered that the PAM module for authentication against LDAP servers processes PasswordPolicyReponse control messages incorrectly, which might lead to an attacker being able to login into a suspended system account. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...

[SECURITY] [DSA 1203-1] New libpam-ldap packages fix access control bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1203-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 2nd, 2006 http://www.debian.org/security/faq -...

Ubuntu 4.10 / 5.04 : openldap2, libpam-ldap, libnss-ldap vulnerabilities (USN-152-1)

Andrea Barisani discovered a flaw in the SSL handling of pam-ldap and libnss-ldap. When a client connected to a slave LDAP server using SSL, the slave server did not use SSL as well when contacting the LDAP master server. This caused passwords and other confident information to be transmitted...

Debian DSA-785-1 : libpam-ldap - authentication bypass

It has been discovered that libpam-ldap, the Pluggable Authentication Module allowing LDAP interfaces, ignores the result of an attempt to authenticate against an LDAP server that does not set an optional data field. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

[SECURITY] [DSA 785-1] New libpam-ldap packages fix authentication bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 785-1 [email protected] http://www.debian.org/security/ Martin Schulze August 25th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 785-1] New libpam-ldap packages fix authentication bypass

-------------------------------------------------------------------------- Debian Security Advisory DSA 785-1 [email protected] http://www.debian.org/security/ Martin Schulze August 25th, 2005 http://www.debian.org/security/faq -...

DSA-785-1 libpam-ldap - authentication bypass

Bulletin has no description...

HP-UX PHCO_29249 : s700_800 11.00 libpam and libpam_unix cumulative patch

s700800 11.00 libpam and libpamunix cumulative patch : The remote HP-UX host is affected by multiple vulnerabilities : - A potential security vulnerability has been identified with HP-UX systems where the vulnerability may be exploited to allow a local user to increase privilege. HPSBUX02091...