[SECURITY] Fedora 27 Update: pam_yubico-2.26-1.fc27

This is pamyubico, a pluggable authentication module that can be used with Linux-PAM and yubikeys. This module supports yubikey OTP checking...

PAM Authentication Service Bypass

salt is vulnerable to PAM authentication service bypass. An attacker can send to the LocalClient an alternate service with a command to bypass the PAM authentication service when the PAM external authentication is enabled...

Design/Logic Flaw

setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assumptions made by pamshells and some daemons which allow access based on a user's shell being listed in /etc/shells. Under some circumstance...

CentOS 6 : ding-libs / sssd (CESA-2018:1877)

An update for sssd and ding-libs is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

SUSE SLES11 Security Update : pam-modules (SUSE-SU-2018:1760-1)

This update for pam-modules fixes the following security issue : - CVE-2011-3172: Ensure that unix2chkpwd calls pamacctmgmt to prevent usage of locked accounts bsc707645. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory...

SUSE-SU-2018:1760-1 Security update for pam-modules

This update for pam-modules fixes the following security issue: - CVE-2011-3172: Ensure that unix2chkpwd calls pamacctmgmt to prevent usage of locked accounts bsc707645...

Moderate: Red Hat Security Advisory: sssd and ding-libs security and bug fix update

An update for sssd and ding-libs is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Security Bulletin: IBM Flex System Manager (FSM) is affected by a Pluggable Authentication Module (PAM) vulnerability (CVE-2013-7041)

Summary A security vulnerability was discovered in PAM that is embedded in the IBM FSM. This bulletin addresses this vulnerabilities. Vulnerability Details CVEID: CVE-2013-7041 DESCRIPTION: pamuserdb module for Pam could provide weaker than expected security, caused by an error in the strncasecmp...

Security Bulletin: Vulnerability in Linux-PAM affects PowerKVM (CVE-2015-3238)

Summary PowerKVM is affected by a vulnerability in Linux-PAM. This vulnerability is now fixed. Vulnerability Details CVEID: CVE-2015-3238 DESCRIPTION: Linux-PAM could allow a local attacker to obtain sensitive information, caused by an error in the unixrunhelperbinary function in the pamunix...

Security Bulletin: A vulnerability in the Linux Pluggable Authentication Module (PAM) affects the IBM FlashSystem model V840 (CVE-2015-3238)

Summary There is a vulnerability in the Linux Pluggable Authentication Module PAM to which the IBM® FlashSystem™ V840 is susceptible. An exploit of this vulnerability could allow a remote attacker to expose sensitive information and/or cause a denial of service. Vulnerability Details CVEID:...

Security Bulletin: Vulnerability in libxml, openssh, PAM, Firefox, affects IBM SmartCloud Provisioning for IBM Software Virtual Appliance

Summary Vulnerability in libxml, openssh, PAM, Firefox, affects IBM SmartCloud Provisioning 2.1 for IBM Software Virtual Appliance CVE-2015-1819, CVE-2015-3238, CVE-2015-5600 and others. Vulnerability Details CVEID: CVE-2015-1819 DESCRIPTION: Libxml is vulnerable to a denial of service, caused by...

Security Bulletin: Vulnerabilities in Open Source pam affect IBM Security Identity Governance Appliance (CVE-2015-3238)

Summary Vulnerabilities in Open Source pam that is used by IBM Security Identity Governance Vulnerability Details CVEID: CVE-2015-3238 DESCRIPTION: Linux-PAM could allow a local attacker to obtain sensitive information, caused by an error in the unixrunhelperbinary function in the pamunix module...

Security Bulletin: A Linux-PAM vulnerability affects IBM Security Access Manager for Mobile (CVE-2015-3238)

Summary Pluggable Authentication Modules PAM provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication. IBM Security Access Manager for Mobile is affected by a Linux-PAM vulnerability. Vulnerability Details CVEID:...

Security Bulletin: A Linux-PAM vulnerability affects IBM Security Access Manager for Web (CVE-2015-3238)

Summary Pluggable Authentication Modules PAM provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication. IBM Security Access Manager for Web is affected by a Linux-PAM vulnerability. Vulnerability Details CVEID:...

Security Bulletin: A vulnerability in Pluggable Authentication Modules (PAM) affects IBM Security Network Protection (CVE-2015-3238)

Summary Pluggable Authentication Modules PAM provide a system whereby administrators can set up authentication policies without having to recompile programs to handle authentication. A security vulnerability has been discovered in PAM used with IBM Security Network Protection. Vulnerability Detai...

CVE-2018-1419

IBM WebSphere MQ 8.0 and 9.0, when configured to use a PAM module for authentication, could allow a user to cause a deadlock in the IBM MQ PAM code which could result in a denial of service. IBM X-Force ID: 138949...

Authentication flaw

IBM WebSphere MQ 8.0 and 9.0, when configured to use a PAM module for authentication, could allow a user to cause a deadlock in the IBM MQ PAM code which could result in a denial of service. IBM X-Force ID: 138949...

CVE-2018-1419

CVE-2018-1419 affects IBM MQ when configured to use the PAM module for authentication. The IBM BD22C8F012157F181C0448F440FB9220CCB7172D67C7288042C8A27BB0A837AE security bulletin confirms a deadlock in the PAM code that could lead to denial of service. Affected products/versions include IBM MQ v8....

Micro Focus SUSE Linux Enterprise Information Disclosure Vulnerability

Micro Focus SUSE Linux Enterprise is a suite of enterprise Linux operating systems from Micro Focus in the UK. A security vulnerability exists in pammodules in versions of Micro Focus SUSE Linux Enterprise prior to 12. An attacker could exploit the vulnerability to log in to an account that shoul...

Free Lossless Image Format Denial of Service Vulnerability (CNVD-2018-11452)

Free Lossless Image Format FLIF is a lossless image format based on MANIAC compression. A security vulnerability exists in the 'TransformPaletteC::process' function in the transform/paletteC.hpp file in FLIF version 0.3. A remote attacker can exploit this vulnerability to cause a denial of servic...