HylaFAX hfaxd with PAM Password Policy Bypass

The remote host is running HylaFAX, a fax / pager server application for Linux / unix. The version of HylaFAX installed on the remote host does not check passwords when authenticating users via hfaxd, its fax server. An attacker can exploit this issue to bypass authentication using a valid userna...

HylaFAX Security advisory - fixed in HylaFAX 4.2.4

I'm passing this on for Patrice Fournier who is not around today. ------------------------------------------------------------------------------ HylaFAX security advisory 4 Jan 2006 Subject: HylaFAX hfaxd and notify/faxrcvd vulnerabilities Introduction: HylaFAX is a mature est. 1991...

CVE-2005-3538

hfaxd in HylaFAX 4.2.3, when PAM support is disabled, accepts arbitrary passwords, which allows remote attackers to gain privileges...

CVE-2005-3538

hfaxd in HylaFAX 4.2.3, when PAM support is disabled, accepts arbitrary passwords, which allows remote attackers to gain privileges...

CVE-2005-4713

Unspecified vulnerability in the SQL logging facility in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service segmentation fault via unspecified vectors, probably involving the pammysqlsqllog function when being used in vsftpd, which does not...

CVE-2005-4713

Unspecified vulnerability in the SQL logging facility in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service segmentation fault via unspecified vectors, probably involving the pammysqlsqllog function when being used in vsftpd, which does not...

DEBIAN-CVE-2005-4713

Unspecified vulnerability in the SQL logging facility in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service segmentation fault via unspecified vectors, probably involving the pammysqlsqllog function when being used in vsftpd, which does not...

CVE-2005-4713

Unspecified vulnerability in the SQL logging facility in PAM-MySQL 0.6.x before 0.6.2 and 0.7.x before 0.7pre3 allows remote attackers to cause a denial of service segmentation fault via unspecified vectors, probably involving the pammysqlsqllog function when being used in vsftpd, which does not...

CVE-2005-3538

hfaxd in HylaFAX 4.2.3, when PAM support is disabled, accepts arbitrary passwords, which allows remote attackers to gain privileges...

GLSA-200510-22 : SELinux PAM: Local password guessing attack

The remote host is affected by the vulnerability described in GLSA-200510-22 SELinux PAM: Local password guessing attack The SELinux patches for PAM introduce a vulnerability allowing a password to be checked with the unixchkpwd utility without delay or logging. This vulnerability doesn't affect...

CVE-2005-2977

The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unixchkpwd, which does not log failed guesses or delay its responses...

CVE-2005-2977

The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unixchkpwd, which does not log failed guesses or delay its responses...

CVE-2005-2977

The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unixchkpwd, which does not log failed guesses or delay its responses...

CVE-2005-2977

The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unixchkpwd, which does not log failed guesses or delay its responses...

CVE-2005-2977

The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unixchkpwd, which does not log failed guesses or delay its responses...

CVE-2005-2977

The CVE-2005-2977 issue affects the SELinux-enabled PAM, specifically PAM before 0.78 r3. The unix_chkpwd helper can be misused by a local attacker to brute-force check passwords without logging failed attempts or delaying responses, enabling partial disclosure risk (confidentiality impact) on lo...

SELinux PAM passwords bruteforcing

There is no delay or logging for invalid password in unixchkpwd utility...

SELinux PAM: Local password guessing attack

Background PAM Pluggable Authentication Modules is an architecture allowing the separation of the development of privilege granting software from the development of secure and appropriate authentication schemes. SELinux is an operating system based on Linux which includes Mandatory Access Control...

[Full-disclosure] [ GLSA 200510-22 ] SELinux PAM: Local password guessing attack

Gentoo Linux Security Advisory GLSA 200510-22 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

RHEL 4 : pam (RHSA-2005:805)

An updated pam package that fixes a security weakness is now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. PAM Pluggable Authentication Modules is a system security tool that allows system administrators t...