pam: pam_env: reading ~/.pam_environment is security risk

The pamenv module in Linux-PAM aka pam 1.1.2 and earlier reads the .pamenvironment file in a user's home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pamenv PAM check...

pam: pam_namespace executes namespace.init with service's environment

pamnamespace.c in the pamnamespace module in Linux-PAM aka pam before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pamnamespace PAM...

pam: pam_xauth missing return value checks from setuid() and similar calls

The runcoprocess function in pamxauth.c in the pamxauth module in Linux-PAM aka pam before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pamxauth PAM check...

pam: pam_namespace executes namespace.init with service's environment

pamnamespace.c in the pamnamespace module in Linux-PAM aka pam before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pamnamespace PAM...

pam: pam_xauth missing return value checks from setuid() and similar calls

The runcoprocess function in pamxauth.c in the pamxauth module in Linux-PAM aka pam before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pamxauth PAM check...

pam_captcha username harvest vulnerability

pamcaptcha is visual text-based CAPTCHA challenge module for PAM that uses figlet to generate the CAPTCHAs. Project site: http://www.semicomplete.com/projects/pamcaptcha/ A site with a screen shot: http://www.michaelboman.org/how-to/securing-ssh-access-with-pam-captcha I found a security problem...

Gentoo Security Advisory GLSA 200909-01 (pam)

The remote host is missing updates announced in advisory GLSA 200909-01. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

Gentoo Security Advisory GLSA 200909-01 (pam)

The remote host is missing updates announced in advisory GLSA 200909-01. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

GLSA-200909-01 : Linux-PAM: Privilege escalation

The remote host is affected by the vulnerability described in GLSA-200909-01 Linux-PAM: Privilege escalation Marcus Granado repoted that Linux-PAM does not properly handle user names that contain Unicode characters. This is related to integer signedness errors in the pamStrTok function in...

Linux-PAM: Privilege escalation

Background Linux-PAM Pluggable Authentication Modules is an architecture allowing the separation of the development of privilege granting software from the development of secure and appropriate authentication schemes. Description Marcus Granado repoted that Linux-PAM does not properly handle user...

[SECURITY] Fedora 9 Update: pam_krb5-2.3.5-1.fc9

This is pamkrb5, a pluggable authentication module that can be used with Linux-PAM and Kerberos 5. This module supports password checking, ticket creation, and optional TGT verification and conversion to Kerberos IV ticke ts. The included pamkrb5afs module also gets AFS tokens if so configured...

[SECURITY] Fedora 11 Update: pam_krb5-2.3.5-1.fc11

This is pamkrb5, a pluggable authentication module that can be used with Linux-PAM and Kerberos 5. This module supports password checking, ticket creation, and optional TGT verification and conversion to Kerberos IV ticke ts. The included pamkrb5afs module also gets AFS tokens if so configured...

[SECURITY] Fedora 10 Update: pam_krb5-2.3.5-1.fc10

This is pamkrb5, a pluggable authentication module that can be used with Linux-PAM and Kerberos 5. This module supports password checking, ticket creation, and optional TGT verification and conversion to Kerberos IV ticke ts. The included pamkrb5afs module also gets AFS tokens if so configured...

CVE-2009-0579

Linux-PAM before 1.0.4 does not enforce the minimum password age MINDAYS as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified...

CVE-2009-0579

Linux-PAM before 1.0.4 does not enforce the minimum password age MINDAYS as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified...

DEBIAN-CVE-2009-0579

Linux-PAM before 1.0.4 does not enforce the minimum password age MINDAYS as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified...

CVE-2009-0579

Linux-PAM before 1.0.4 does not enforce the minimum password age MINDAYS as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified...

Design/Logic Flaw

Linux-PAM before 1.0.4 does not enforce the minimum password age MINDAYS as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified...

CVE-2009-0579

Linux-PAM before 1.0.4 does not enforce the minimum password age MINDAYS as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified...

CVE-2009-0579

Linux-PAM before 1.0.4 does not enforce the minimum password age MINDAYS as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified...